redline | 854e5c0dbeb31b0953c41b36dc88fa4e959c00c848fb723dc2f9223aeb5a359a

Analysis

max time kernel
150s
max time network
162s
platform
windows10_x64
resource
win10v20210408
submitted
11/08/2021, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7D12550F98DC72B2F48816A9E979DFE9.exe
Size 4.6MB
Sample210811-vd4mwarwys
SHA256 854e5c0dbeb31b0953c41b36dc88fa4e959c00c848fb723dc2f9223aeb5a359a
MD5 7d12550f98dc72b2f48816a9e979dfe9
SHA1 2c69cb985d7c422faa5c2e424b72ca45e94a6666
SHA512 5bc8141307ce2ac887961717e6f087f087da87c9ab654fcbeb583bdbb23081559d60fca36d2d0413303ceefaa70ae58fd8ec367f1045817d54ce7432fb4fdd7e
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader socelars vidar 706 7new aspackv2 backdoor infostealer persistence stealer suricata trojan

Malware Config

Extracted

Family

vidar

Version

39.9

Botnet

https://prophefliloc.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

7new

sytareliar.xyz:80
yabelesatg.xyz:80
ceneimarck.xyz:80

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4732-270-0x0000000004C10000-0x0000000004C43000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab60-118.dat	family_socelars
behavioral2/files/0x000100000001ab60-119.dat	family_socelars
behavioral2/files/0x000100000001ab6a-177.dat	family_socelars
behavioral2/files/0x000100000001ab6a-179.dat	family_socelars
behavioral2/files/0x0003000000015534-275.dat	family_socelars
behavioral2/files/0x0003000000015534-274.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/1108-210-0x00000000049D0000-0x0000000004A6D000-memory.dmp	family_vidar
behavioral2/memory/1108-212-0x0000000000400000-0x0000000002CC9000-memory.dmp	family_vidar
behavioral2/memory/3832-366-0x00000000048D0000-0x000000000496D000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000100000001ab5c-121.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5b-122.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5b-127.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5b-125.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5c-124.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5e-129.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5e-128.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

pid	Process
3600	setup_installer.exe
60	setup_install.exe
1128	1a6424056cd08a61.exe
1280	23ffe9e2dd84.exe
1380	0e344493feb412.exe
1108	62bac2450133.exe
1580	325a324218d375.exe
1760	ace3e10e2377.exe
2008	ef59bf9776.exe
2096	e26a2e8f52a70909.exe
2744	1a6424056cd08a6010.exe
2812	0721a4dcf368.exe
3228	1cr.exe
4396	1a6424056cd08a61.exe

Loads dropped DLL 7 IoCs

pid	Process
60	setup_install.exe
60	setup_install.exe
60	setup_install.exe
60	setup_install.exe
60	setup_install.exe
60	setup_install.exe
60	setup_install.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	325a324218d375.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	325a324218d375.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ipinfo.io
15	ipinfo.io
118	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
5988	1108	WerFault.exe	99
6124	2820	WerFault.exe	122
5960	3928	WerFault.exe	116
4264	5152	WerFault.exe	141
5172	2820	WerFault.exe	122

Kills process with taskkill 1 IoCs

evasion

pid	Process
4028	taskkill.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2744	1a6424056cd08a6010.exe
Token: SeAssignPrimaryTokenPrivilege	2744	1a6424056cd08a6010.exe
Token: SeLockMemoryPrivilege	2744	1a6424056cd08a6010.exe
Token: SeIncreaseQuotaPrivilege	2744	1a6424056cd08a6010.exe
Token: SeMachineAccountPrivilege	2744	1a6424056cd08a6010.exe
Token: SeTcbPrivilege	2744	1a6424056cd08a6010.exe
Token: SeSecurityPrivilege	2744	1a6424056cd08a6010.exe
Token: SeTakeOwnershipPrivilege	2744	1a6424056cd08a6010.exe
Token: SeLoadDriverPrivilege	2744	1a6424056cd08a6010.exe
Token: SeSystemProfilePrivilege	2744	1a6424056cd08a6010.exe
Token: SeSystemtimePrivilege	2744	1a6424056cd08a6010.exe
Token: SeProfSingleProcessPrivilege	2744	1a6424056cd08a6010.exe
Token: SeIncBasePriorityPrivilege	2744	1a6424056cd08a6010.exe
Token: SeCreatePagefilePrivilege	2744	1a6424056cd08a6010.exe
Token: SeCreatePermanentPrivilege	2744	1a6424056cd08a6010.exe
Token: SeBackupPrivilege	2744	1a6424056cd08a6010.exe
Token: SeRestorePrivilege	2744	1a6424056cd08a6010.exe
Token: SeShutdownPrivilege	2744	1a6424056cd08a6010.exe
Token: SeDebugPrivilege	2744	1a6424056cd08a6010.exe
Token: SeAuditPrivilege	2744	1a6424056cd08a6010.exe
Token: SeSystemEnvironmentPrivilege	2744	1a6424056cd08a6010.exe
Token: SeChangeNotifyPrivilege	2744	1a6424056cd08a6010.exe
Token: SeRemoteShutdownPrivilege	2744	1a6424056cd08a6010.exe
Token: SeUndockPrivilege	2744	1a6424056cd08a6010.exe
Token: SeSyncAgentPrivilege	2744	1a6424056cd08a6010.exe
Token: SeEnableDelegationPrivilege	2744	1a6424056cd08a6010.exe
Token: SeManageVolumePrivilege	2744	1a6424056cd08a6010.exe
Token: SeImpersonatePrivilege	2744	1a6424056cd08a6010.exe
Token: SeCreateGlobalPrivilege	2744	1a6424056cd08a6010.exe
Token: 31	2744	1a6424056cd08a6010.exe
Token: 32	2744	1a6424056cd08a6010.exe
Token: 33	2744	1a6424056cd08a6010.exe
Token: 34	2744	1a6424056cd08a6010.exe
Token: 35	2744	1a6424056cd08a6010.exe
Token: SeDebugPrivilege	2812	0721a4dcf368.exe
Token: SeDebugPrivilege	2008	ef59bf9776.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 3600	4648	7D12550F98DC72B2F48816A9E979DFE9.exe	75
PID 4648 wrote to memory of 3600	4648	7D12550F98DC72B2F48816A9E979DFE9.exe	75
PID 4648 wrote to memory of 3600	4648	7D12550F98DC72B2F48816A9E979DFE9.exe	75
PID 3600 wrote to memory of 60	3600	setup_installer.exe	76
PID 3600 wrote to memory of 60	3600	setup_installer.exe	76
PID 3600 wrote to memory of 60	3600	setup_installer.exe	76
PID 60 wrote to memory of 4124	60	setup_install.exe	79
PID 60 wrote to memory of 4124	60	setup_install.exe	79
PID 60 wrote to memory of 4124	60	setup_install.exe	79
PID 60 wrote to memory of 2432	60	setup_install.exe	80
PID 60 wrote to memory of 2432	60	setup_install.exe	80
PID 60 wrote to memory of 2432	60	setup_install.exe	80
PID 60 wrote to memory of 492	60	setup_install.exe	81
PID 60 wrote to memory of 492	60	setup_install.exe	81
PID 60 wrote to memory of 492	60	setup_install.exe	81
PID 60 wrote to memory of 580	60	setup_install.exe	82
PID 60 wrote to memory of 580	60	setup_install.exe	82
PID 60 wrote to memory of 580	60	setup_install.exe	82
PID 60 wrote to memory of 632	60	setup_install.exe	83
PID 60 wrote to memory of 632	60	setup_install.exe	83
PID 60 wrote to memory of 632	60	setup_install.exe	83
PID 60 wrote to memory of 816	60	setup_install.exe	84
PID 60 wrote to memory of 816	60	setup_install.exe	84
PID 60 wrote to memory of 816	60	setup_install.exe	84
PID 60 wrote to memory of 1012	60	setup_install.exe	85
PID 60 wrote to memory of 1012	60	setup_install.exe	85
PID 60 wrote to memory of 1012	60	setup_install.exe	85
PID 60 wrote to memory of 392	60	setup_install.exe	101
PID 60 wrote to memory of 392	60	setup_install.exe	101
PID 60 wrote to memory of 392	60	setup_install.exe	101
PID 60 wrote to memory of 584	60	setup_install.exe	100
PID 60 wrote to memory of 584	60	setup_install.exe	100
PID 60 wrote to memory of 584	60	setup_install.exe	100
PID 60 wrote to memory of 1080	60	setup_install.exe	86
PID 60 wrote to memory of 1080	60	setup_install.exe	86
PID 60 wrote to memory of 1080	60	setup_install.exe	86
PID 580 wrote to memory of 1108	580	cmd.exe	99
PID 580 wrote to memory of 1108	580	cmd.exe	99
PID 580 wrote to memory of 1108	580	cmd.exe	99
PID 4124 wrote to memory of 1128	4124	cmd.exe	98
PID 4124 wrote to memory of 1128	4124	cmd.exe	98
PID 4124 wrote to memory of 1128	4124	cmd.exe	98
PID 492 wrote to memory of 1280	492	cmd.exe	88
PID 492 wrote to memory of 1280	492	cmd.exe	88
PID 492 wrote to memory of 1280	492	cmd.exe	88
PID 2432 wrote to memory of 1380	2432	cmd.exe	87
PID 2432 wrote to memory of 1380	2432	cmd.exe	87
PID 2432 wrote to memory of 1380	2432	cmd.exe	87
PID 632 wrote to memory of 1580	632	cmd.exe	97
PID 632 wrote to memory of 1580	632	cmd.exe	97
PID 816 wrote to memory of 1760	816	cmd.exe	89
PID 816 wrote to memory of 1760	816	cmd.exe	89
PID 816 wrote to memory of 1760	816	cmd.exe	89
PID 1012 wrote to memory of 2008	1012	cmd.exe	96
PID 1012 wrote to memory of 2008	1012	cmd.exe	96
PID 584 wrote to memory of 2096	584	cmd.exe	94
PID 584 wrote to memory of 2096	584	cmd.exe	94
PID 1080 wrote to memory of 2744	1080	cmd.exe	91
PID 1080 wrote to memory of 2744	1080	cmd.exe	91
PID 1080 wrote to memory of 2744	1080	cmd.exe	91
PID 392 wrote to memory of 2812	392	cmd.exe	90
PID 392 wrote to memory of 2812	392	cmd.exe	90
PID 1580 wrote to memory of 3228	1580	325a324218d375.exe	92
PID 1580 wrote to memory of 3228	1580	325a324218d375.exe	92

C:\Users\Admin\AppData\Local\Temp\7D12550F98DC72B2F48816A9E979DFE9.exe
"C:\Users\Admin\AppData\Local\Temp\7D12550F98DC72B2F48816A9E979DFE9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 1a6424056cd08a61.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\1a6424056cd08a61.exe
        
        1a6424056cd08a61.exe
        5⤵
        Executes dropped EXE
        
        PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 0e344493feb412.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\0e344493feb412.exe
        
        0e344493feb412.exe
        5⤵
        Executes dropped EXE
        
        PID:1380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 23ffe9e2dd84.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:492
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\23ffe9e2dd84.exe
        
        23ffe9e2dd84.exe
        5⤵
        Executes dropped EXE
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        6⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        
        PID:1908
        
        C:\Windows\winnetdriv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1628720574 0
        7⤵
        
        PID:4976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 62bac2450133.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:580
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\62bac2450133.exe
        
        62bac2450133.exe
        5⤵
        Executes dropped EXE
        
        PID:1108
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 924
        6⤵
        Program crash
        
        PID:5988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 325a324218d375.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\325a324218d375.exe
        
        325a324218d375.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ace3e10e2377.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\ace3e10e2377.exe
        
        ace3e10e2377.exe
        5⤵
        Executes dropped EXE
        
        PID:1760
      - C:\Users\Admin\Documents\_1rU0_ah5GYCyxfyGd9BEjUA.exe
        
        "C:\Users\Admin\Documents\_1rU0_ah5GYCyxfyGd9BEjUA.exe"
        6⤵
        
        PID:3060
      - C:\Users\Admin\Documents\ROhu5ufLylLPrwZD6N2w7RJy.exe
        
        "C:\Users\Admin\Documents\ROhu5ufLylLPrwZD6N2w7RJy.exe"
        6⤵
        
        PID:2624
      - C:\Users\Admin\Documents\I9vx4ueKE5gj7uT_fTXnesmh.exe
        
        "C:\Users\Admin\Documents\I9vx4ueKE5gj7uT_fTXnesmh.exe"
        6⤵
        
        PID:3596
      - C:\Users\Admin\Documents\xNFEIjk6c03ukc1SxQC7YZ6q.exe
        
        "C:\Users\Admin\Documents\xNFEIjk6c03ukc1SxQC7YZ6q.exe"
        6⤵
        
        PID:2224
      - C:\Users\Admin\Documents\WK18I9d2d8Cm346KeOxDly55.exe
        
        "C:\Users\Admin\Documents\WK18I9d2d8Cm346KeOxDly55.exe"
        6⤵
        
        PID:3168
      - C:\Users\Admin\Documents\qAxZcSERL5R7kokN_N1LOuZB.exe
        
        "C:\Users\Admin\Documents\qAxZcSERL5R7kokN_N1LOuZB.exe"
        6⤵
        
        PID:3852
      - C:\Users\Admin\Documents\B7omijmPK_c4g7NoEDAQxK0K.exe
        
        "C:\Users\Admin\Documents\B7omijmPK_c4g7NoEDAQxK0K.exe"
        6⤵
        
        PID:3344
        
        C:\Users\Admin\Documents\B7omijmPK_c4g7NoEDAQxK0K.exe
        
        C:\Users\Admin\Documents\B7omijmPK_c4g7NoEDAQxK0K.exe
        7⤵
        
        PID:3068
      - C:\Users\Admin\Documents\d0eIHrSQQ7aEnuaR1CsKEPW5.exe
        
        "C:\Users\Admin\Documents\d0eIHrSQQ7aEnuaR1CsKEPW5.exe"
        6⤵
        
        PID:3692
        
        C:\Users\Admin\Documents\d0eIHrSQQ7aEnuaR1CsKEPW5.exe
        
        "C:\Users\Admin\Documents\d0eIHrSQQ7aEnuaR1CsKEPW5.exe"
        7⤵
        
        PID:6012
      - C:\Users\Admin\Documents\A21Z2vBgeQKYvjSspCLerh5u.exe
        
        "C:\Users\Admin\Documents\A21Z2vBgeQKYvjSspCLerh5u.exe"
        6⤵
        
        PID:4696
      - C:\Users\Admin\Documents\BY0G41jMiCMUz3kFkblqGviI.exe
        
        "C:\Users\Admin\Documents\BY0G41jMiCMUz3kFkblqGviI.exe"
        6⤵
        
        PID:2668
      - C:\Users\Admin\Documents\tfhRxOrlu0BqLdbRgUxV2zIa.exe
        
        "C:\Users\Admin\Documents\tfhRxOrlu0BqLdbRgUxV2zIa.exe"
        6⤵
        
        PID:4372
      - C:\Users\Admin\Documents\_zbaFZMRD8j4sxN6nkA0EIBv.exe
        
        "C:\Users\Admin\Documents\_zbaFZMRD8j4sxN6nkA0EIBv.exe"
        6⤵
        
        PID:3688
      - C:\Users\Admin\Documents\auOsT9Iqox0VbD4y8GJbUepc.exe
        
        "C:\Users\Admin\Documents\auOsT9Iqox0VbD4y8GJbUepc.exe"
        6⤵
        
        PID:3832
      - C:\Users\Admin\Documents\9gs_pzPEZcOMlMCFzWMPugKP.exe
        
        "C:\Users\Admin\Documents\9gs_pzPEZcOMlMCFzWMPugKP.exe"
        6⤵
        
        PID:5220
      - C:\Users\Admin\Documents\x5yOwE6edUy33GXk_yvFUV3u.exe
        
        "C:\Users\Admin\Documents\x5yOwE6edUy33GXk_yvFUV3u.exe"
        6⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 476
        7⤵
        Program crash
        
        PID:4264
      - C:\Users\Admin\Documents\sH2jdGLnHvrXsPVlgeuVbCbT.exe
        
        "C:\Users\Admin\Documents\sH2jdGLnHvrXsPVlgeuVbCbT.exe"
        6⤵
        
        PID:5140
      - C:\Users\Admin\Documents\GZJD0qbQxHuV6zeOcG0VPhEL.exe
        
        "C:\Users\Admin\Documents\GZJD0qbQxHuV6zeOcG0VPhEL.exe"
        6⤵
        
        PID:2132
      - C:\Users\Admin\Documents\YH548NVRYggDKSVvjFBLh4gs.exe
        
        "C:\Users\Admin\Documents\YH548NVRYggDKSVvjFBLh4gs.exe"
        6⤵
        
        PID:3096
      - C:\Users\Admin\Documents\TN67nKsSAJYkipJuJi7Ox8pP.exe
        
        "C:\Users\Admin\Documents\TN67nKsSAJYkipJuJi7Ox8pP.exe"
        6⤵
        
        PID:5332
      - C:\Users\Admin\Documents\tvqLlnbGUCVLkR7JpoICBkeN.exe
        
        "C:\Users\Admin\Documents\tvqLlnbGUCVLkR7JpoICBkeN.exe"
        6⤵
        
        PID:5612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ef59bf9776.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\ef59bf9776.exe
        
        ef59bf9776.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
      - C:\Users\Admin\AppData\Roaming\1556639.exe
        
        "C:\Users\Admin\AppData\Roaming\1556639.exe"
        6⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Roaming\5238084.exe
        
        "C:\Users\Admin\AppData\Roaming\5238084.exe"
        6⤵
        
        PID:2320
      - C:\Users\Admin\AppData\Roaming\1696418.exe
        
        "C:\Users\Admin\AppData\Roaming\1696418.exe"
        6⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Roaming\6407267.exe
        
        "C:\Users\Admin\AppData\Roaming\6407267.exe"
        6⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:4124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 1a6424056cd08a6010.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\1a6424056cd08a6010.exe
        
        1a6424056cd08a6010.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:4028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c e26a2e8f52a70909.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 0721a4dcf368.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:392

C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\0721a4dcf368.exe
0721a4dcf368.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\3002.exe
    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
    3⤵
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\3002.exe
      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
      4⤵
      PID:4568
- - C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
    "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
    "C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"
    3⤵
    PID:3928
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3928 -s 1532
      4⤵
      Program crash
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\mysetnew.exe
    "C:\Users\Admin\AppData\Local\Temp\mysetnew.exe"
    3⤵
    PID:1112
- - C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe
    "C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"
    3⤵
    PID:2672
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    PID:2820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 764
      4⤵
      Program crash
      PID:6124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 936
      4⤵
      Program crash
      PID:5172
- - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
    3⤵
    PID:1380

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1cr.exe
1⤵
- Executes dropped EXE
PID:3228

C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\1a6424056cd08a61.exe
"C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\1a6424056cd08a61.exe" -a
1⤵
- Executes dropped EXE
PID:4396

C:\Users\Admin\AppData\Local\Temp\7zS01E780A4\e26a2e8f52a70909.exe
e26a2e8f52a70909.exe
1⤵
- Executes dropped EXE
PID:2096
- C:\Users\Admin\AppData\Local\Temp\11111.exe
  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\11111.exe
  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:5772
- C:\Users\Admin\AppData\Local\Temp\11111.exe
  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:2268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-133-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/60-138-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/60-134-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/60-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/60-136-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/60-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/60-132-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1108-212-0x0000000000400000-0x0000000002CC9000-memory.dmp

Download

memory/1108-210-0x00000000049D0000-0x0000000004A6D000-memory.dmp

Download

memory/1120-236-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/1120-253-0x00000000012E0000-0x00000000012E7000-memory.dmp

Download

memory/1280-190-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/1380-211-0x0000000000400000-0x0000000002C6D000-memory.dmp

Download

memory/1380-343-0x00000000059B0000-0x00000000059B1000-memory.dmp

Download

memory/1380-201-0x0000000003030000-0x0000000003039000-memory.dmp

Download

memory/1908-220-0x0000000000CC0000-0x0000000000DA4000-memory.dmp

Download

memory/2008-180-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/2008-196-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/2008-188-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/2008-200-0x00000000008A0000-0x00000000008A2000-memory.dmp

Download

memory/2008-193-0x0000000002060000-0x000000000207B000-memory.dmp

Download

memory/2096-309-0x0000025BC0C70000-0x0000025BC0D3F000-memory.dmp

Download

memory/2096-308-0x0000025BC0C00000-0x0000025BC0C6F000-memory.dmp

Download

memory/2132-385-0x000000001B030000-0x000000001B032000-memory.dmp

Download

memory/2224-373-0x0000000002EF0000-0x0000000002F2B000-memory.dmp

Download

memory/2224-378-0x0000000000400000-0x0000000002C84000-memory.dmp

Download

memory/2320-246-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/2320-266-0x0000000004C90000-0x0000000004C91000-memory.dmp

Download

memory/2320-268-0x0000000007380000-0x00000000073AA000-memory.dmp

Download

memory/2624-402-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/2660-262-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/2660-346-0x000000001CAA0000-0x000000001CAA2000-memory.dmp

Download

memory/2668-410-0x0000000077580000-0x000000007770E000-memory.dmp

Download

memory/2672-307-0x000000001AC20000-0x000000001AC22000-memory.dmp

Download

memory/2672-301-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/2812-189-0x000000001B6D0000-0x000000001B6D2000-memory.dmp

Download

memory/2812-184-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/2820-376-0x0000000000400000-0x0000000002C79000-memory.dmp

Download

memory/2820-363-0x0000000002C80000-0x0000000002DCA000-memory.dmp

Download

memory/3048-298-0x00000000023E0000-0x00000000023F6000-memory.dmp

Download

memory/3096-401-0x000000001B410000-0x000000001B412000-memory.dmp

Download

memory/3168-325-0x0000000000E10000-0x0000000000F5A000-memory.dmp

Download

memory/3168-344-0x0000000000F60000-0x0000000000F72000-memory.dmp

Download

memory/3228-202-0x0000000004B10000-0x000000000500E000-memory.dmp

Download

memory/3228-197-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/3228-209-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/3228-195-0x0000000005010000-0x0000000005011000-memory.dmp

Download

memory/3228-192-0x0000000000050000-0x0000000000051000-memory.dmp

Download

memory/3228-205-0x00000000049A0000-0x00000000049A1000-memory.dmp

Download

memory/3344-382-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/3596-392-0x0000000005670000-0x0000000005B6E000-memory.dmp

Download

memory/3692-394-0x00000000001D0000-0x00000000001DA000-memory.dmp

Download

memory/3832-366-0x00000000048D0000-0x000000000496D000-memory.dmp

Download

memory/3832-399-0x0000000000400000-0x0000000002CC5000-memory.dmp

Download

memory/3928-285-0x0000000000150000-0x0000000000151000-memory.dmp

Download

memory/3928-295-0x0000000000890000-0x0000000000892000-memory.dmp

Download

memory/4012-221-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/4124-297-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/4372-395-0x0000000004900000-0x000000000499D000-memory.dmp

Download

memory/4372-405-0x0000000000400000-0x0000000002CC5000-memory.dmp

Download

memory/4572-231-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/4572-242-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/4572-254-0x00000000010D0000-0x0000000001104000-memory.dmp

Download

memory/4572-264-0x000000001B730000-0x000000001B732000-memory.dmp

Download

memory/4572-263-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/4596-207-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/4596-337-0x000000001C680000-0x000000001C682000-memory.dmp

Download

memory/4696-403-0x0000000000400000-0x0000000002CB5000-memory.dmp

Download

memory/4696-387-0x00000000048C0000-0x0000000004953000-memory.dmp

Download

memory/4732-270-0x0000000004C10000-0x0000000004C43000-memory.dmp

Download

memory/4732-281-0x0000000007200000-0x0000000007201000-memory.dmp

Download

memory/4732-271-0x0000000007790000-0x0000000007791000-memory.dmp

Download

memory/4732-293-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/4732-299-0x00000000073D0000-0x00000000073D1000-memory.dmp

Download

memory/4732-289-0x0000000007240000-0x0000000007241000-memory.dmp

Download

memory/4732-257-0x00000000003C0000-0x00000000003C1000-memory.dmp

Download

memory/4732-278-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Download

memory/4976-245-0x00000000007C0000-0x00000000008A4000-memory.dmp

Download

memory/5140-367-0x00000000048A0000-0x00000000048CF000-memory.dmp

Download

memory/5140-384-0x0000000000400000-0x0000000002C7F000-memory.dmp

Download

memory/5152-368-0x0000000002CC0000-0x0000000002CC9000-memory.dmp

Download

memory/5152-407-0x0000000000400000-0x0000000002C69000-memory.dmp

Download

memory/5220-386-0x0000000077580000-0x000000007770E000-memory.dmp

Download

memory/5220-418-0x0000000003B80000-0x0000000003B81000-memory.dmp

Download

memory/6012-389-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads