glupteba | cf8a60b5e39660a02d37d4d5f1d28e392427c1da05142d4a651cd1c267d07cc1

Resubmissions

13/08/2021, 20:44

210813-ysrz4wznb210

13/08/2021, 18:11

210813-xew4hd2n4e10

Analysis

max time kernel
13s
max time network
175s
platform
windows7_x64
resource
win7v20210410
submitted
13/08/2021, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0B6B2968E8F090B22BC47ABAB70C4DD0.exe
Size 5.7MB
Sample210813-xew4hd2n4e
SHA256 cf8a60b5e39660a02d37d4d5f1d28e392427c1da05142d4a651cd1c267d07cc1
MD5 0b6b2968e8f090b22bc47abab70c4dd0
SHA1 216f0ada991deb26c4607dd142ea5f0176484cc0
SHA512 8598904d81f4ee2a31e9c3a9e2634b69b1a2cd61f92f679c2fa52ee302eef1524045adfd4fb3f5176218c5a53ace6263ac8a1c19952a9083b3339484e0468037
MD5 SHA1 SHA512

Score

10^/10

glupteba metasploit redline smokeloader vidar 706 aspackv2 backdoor dropper evasion infostealer loader stealer suricata themida trojan vmprotect

Malware Config

Extracted

Family

vidar

Version

Botnet

https://lenak513.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1916-349-0x0000000002E20000-0x0000000003746000-memory.dmp	family_glupteba
behavioral1/memory/1916-350-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2172	2120	rundll32.exe	51
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	2120	rundll32.exe	51

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2496-305-0x0000000000418F86-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/572-172-0x0000000003770000-0x000000000380D000-memory.dmp	family_vidar
behavioral1/memory/572-173-0x0000000000400000-0x000000000334B000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130e8-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e7-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e7-78.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e8-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130ea-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130ea-83.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
1768	setup_installer.exe
748	setup_install.exe
912	20383e5a9a4c5112.exe
1412	27ce46284501.exe
1832	3d0c613fcb2403.exe
1736	2d7080268fee447.exe
572	b001a8f56.exe
484	79d822fc709e78.exe
924	e9e6055abb695524.exe
1784	e9e6055abb695524.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/3316-346-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	27ce46284501.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	27ce46284501.exe

Loads dropped DLL 35 IoCs

pid	Process
2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe
1768	setup_installer.exe
1768	setup_installer.exe
1768	setup_installer.exe
1768	setup_installer.exe
1768	setup_installer.exe
1768	setup_installer.exe
748	setup_install.exe
748	setup_install.exe
748	setup_install.exe
748	setup_install.exe
748	setup_install.exe
748	setup_install.exe
748	setup_install.exe
748	setup_install.exe
676	cmd.exe
1892	cmd.exe
744	cmd.exe
1412	27ce46284501.exe
1412	27ce46284501.exe
1940	cmd.exe
1360	cmd.exe
1648	cmd.exe
1648	cmd.exe
1664	cmd.exe
1664	cmd.exe
572	b001a8f56.exe
572	b001a8f56.exe
484	79d822fc709e78.exe
484	79d822fc709e78.exe
924	e9e6055abb695524.exe
924	e9e6055abb695524.exe
924	e9e6055abb695524.exe
1784	e9e6055abb695524.exe
1784	e9e6055abb695524.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00030000000130ed-111.dat	themida
behavioral1/files/0x00030000000130ed-110.dat	themida
behavioral1/files/0x00030000000130ed-125.dat	themida
behavioral1/files/0x00030000000130ed-124.dat	themida
behavioral1/files/0x00030000000130ed-117.dat	themida
behavioral1/memory/1412-174-0x0000000000BA0000-0x0000000000BA1000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	27ce46284501.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ipinfo.io
8	ipinfo.io
30	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1412	27ce46284501.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2788	2312	WerFault.exe	55
1452	572	WerFault.exe	47
2500	2656	WerFault.exe	61
3864	3316	WerFault.exe	108

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2488	schtasks.exe
3452	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3828	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	2d7080268fee447.exe
Token: SeDebugPrivilege	912	20383e5a9a4c5112.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 2028 wrote to memory of 1768	2028	0B6B2968E8F090B22BC47ABAB70C4DD0.exe	27
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 1768 wrote to memory of 748	1768	setup_installer.exe	30
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 1892	748	setup_install.exe	36
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 676	748	setup_install.exe	32
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 1664	748	setup_install.exe	33
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 744	748	setup_install.exe	34
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 748 wrote to memory of 596	748	setup_install.exe	35
PID 676 wrote to memory of 912	676	cmd.exe	48
PID 676 wrote to memory of 912	676	cmd.exe	48
PID 676 wrote to memory of 912	676	cmd.exe	48
PID 676 wrote to memory of 912	676	cmd.exe	48
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 1892 wrote to memory of 1412	1892	cmd.exe	37
PID 748 wrote to memory of 1940	748	setup_install.exe	39
PID 748 wrote to memory of 1940	748	setup_install.exe	39
PID 748 wrote to memory of 1940	748	setup_install.exe	39
PID 748 wrote to memory of 1940	748	setup_install.exe	39

C:\Users\Admin\AppData\Local\Temp\0B6B2968E8F090B22BC47ABAB70C4DD0.exe
"C:\Users\Admin\AppData\Local\Temp\0B6B2968E8F090B22BC47ABAB70C4DD0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 20383e5a9a4c5112.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\20383e5a9a4c5112.exe
        
        20383e5a9a4c5112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
      - C:\Users\Admin\AppData\Roaming\5849404.exe
        
        "C:\Users\Admin\AppData\Roaming\5849404.exe"
        6⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Roaming\8368739.exe
        
        "C:\Users\Admin\AppData\Roaming\8368739.exe"
        6⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Roaming\1642406.exe
        
        "C:\Users\Admin\AppData\Roaming\1642406.exe"
        6⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Roaming\4712530.exe
        
        "C:\Users\Admin\AppData\Roaming\4712530.exe"
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Roaming\6116509.exe
        
        "C:\Users\Admin\AppData\Roaming\6116509.exe"
        6⤵
        
        PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c e9e6055abb695524.exe
      4⤵
      Loads dropped DLL
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\e9e6055abb695524.exe
        
        e9e6055abb695524.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 3d0c613fcb2403.exe
      4⤵
      Loads dropped DLL
      PID:744
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\3d0c613fcb2403.exe
        
        3d0c613fcb2403.exe
        5⤵
        Executes dropped EXE
        
        PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c f9a302645.exe
      4⤵
      PID:596
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\f9a302645.exe
        
        f9a302645.exe
        5⤵
        
        PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 27ce46284501.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\27ce46284501.exe
        
        27ce46284501.exe
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1412
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c b001a8f56.exe
      4⤵
      Loads dropped DLL
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\b001a8f56.exe
        
        b001a8f56.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 984
        6⤵
        Program crash
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 2d7080268fee447.exe
      4⤵
      Loads dropped DLL
      PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\2d7080268fee447.exe
        
        2d7080268fee447.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        7⤵
        
        PID:2520
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:2984
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:2488
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:3040
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:3268
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:3452
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
        7⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        8⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"
        7⤵
        
        PID:2656
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2656 -s 1400
        8⤵
        Program crash
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 1020
        7⤵
        Program crash
        
        PID:2788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 79d822fc709e78.exe
      4⤵
      Loads dropped DLL
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\79d822fc709e78.exe
        
        79d822fc709e78.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:484
      - C:\Users\Admin\Documents\4BkWCaOfIMYi6yfUiaGQmKx0.exe
        
        "C:\Users\Admin\Documents\4BkWCaOfIMYi6yfUiaGQmKx0.exe"
        6⤵
        
        PID:2776
      - C:\Users\Admin\Documents\Fhzj5kb0MtZU7Az94BAJ4o5m.exe
        
        "C:\Users\Admin\Documents\Fhzj5kb0MtZU7Az94BAJ4o5m.exe"
        6⤵
        
        PID:2820
      - C:\Users\Admin\Documents\B7VSfROnusJmpC9vFqKjMXQv.exe
        
        "C:\Users\Admin\Documents\B7VSfROnusJmpC9vFqKjMXQv.exe"
        6⤵
        
        PID:2844
      - C:\Users\Admin\Documents\9JjOem5aQpdh30efoEiblJTf.exe
        
        "C:\Users\Admin\Documents\9JjOem5aQpdh30efoEiblJTf.exe"
        6⤵
        
        PID:2884
      - C:\Users\Admin\Documents\UX1ChaSoyOkiYKu22k0WIgHi.exe
        
        "C:\Users\Admin\Documents\UX1ChaSoyOkiYKu22k0WIgHi.exe"
        6⤵
        
        PID:2988
      - C:\Users\Admin\Documents\eUg5_is54zFntCQMvbeNd2Ef.exe
        
        "C:\Users\Admin\Documents\eUg5_is54zFntCQMvbeNd2Ef.exe"
        6⤵
        
        PID:2980
        
        C:\Users\Admin\Documents\eUg5_is54zFntCQMvbeNd2Ef.exe
        
        "C:\Users\Admin\Documents\eUg5_is54zFntCQMvbeNd2Ef.exe"
        7⤵
        
        PID:2176
      - C:\Users\Admin\Documents\aiE911u1RPUBvv6QJujcU_yp.exe
        
        "C:\Users\Admin\Documents\aiE911u1RPUBvv6QJujcU_yp.exe"
        6⤵
        
        PID:2968
      - C:\Users\Admin\Documents\x0RQvKJ1ewM1AbaqeQmcz6ee.exe
        
        "C:\Users\Admin\Documents\x0RQvKJ1ewM1AbaqeQmcz6ee.exe"
        6⤵
        
        PID:2952
        
        C:\Users\Admin\Documents\x0RQvKJ1ewM1AbaqeQmcz6ee.exe
        
        C:\Users\Admin\Documents\x0RQvKJ1ewM1AbaqeQmcz6ee.exe
        7⤵
        
        PID:2496
      - C:\Users\Admin\Documents\bbTQ8Fxwn5JFQtXPhzKOq_wV.exe
        
        "C:\Users\Admin\Documents\bbTQ8Fxwn5JFQtXPhzKOq_wV.exe"
        6⤵
        
        PID:2944
      - C:\Users\Admin\Documents\UG1_RkdzWumEB9JVQCgdhqQJ.exe
        
        "C:\Users\Admin\Documents\UG1_RkdzWumEB9JVQCgdhqQJ.exe"
        6⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Roaming\8646490.exe
        
        "C:\Users\Admin\AppData\Roaming\8646490.exe"
        7⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Roaming\5723219.exe
        
        "C:\Users\Admin\AppData\Roaming\5723219.exe"
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\6141929.exe
        
        "C:\Users\Admin\AppData\Roaming\6141929.exe"
        7⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Roaming\5617556.exe
        
        "C:\Users\Admin\AppData\Roaming\5617556.exe"
        7⤵
        
        PID:2600
      - C:\Users\Admin\Documents\Py25WQTH2vzLCYZmsKoJXOTP.exe
        
        "C:\Users\Admin\Documents\Py25WQTH2vzLCYZmsKoJXOTP.exe"
        6⤵
        
        PID:1188
      - C:\Users\Admin\Documents\0sWFGLA2xlIBGtlNzwaL67ZJ.exe
        
        "C:\Users\Admin\Documents\0sWFGLA2xlIBGtlNzwaL67ZJ.exe"
        6⤵
        
        PID:2068
      - C:\Users\Admin\Documents\tMLv1ZR_OHcUKzLTfD69WMSA.exe
        
        "C:\Users\Admin\Documents\tMLv1ZR_OHcUKzLTfD69WMSA.exe"
        6⤵
        
        PID:1096
        
        C:\Program Files (x86)\Company\NewProduct\customer3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
        8⤵
        
        PID:3840
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 276
        8⤵
        Program crash
        
        PID:3864
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:3052
      - C:\Users\Admin\Documents\S_0PjchSlRr6fIv4H7StiZZ9.exe
        
        "C:\Users\Admin\Documents\S_0PjchSlRr6fIv4H7StiZZ9.exe"
        6⤵
        
        PID:1916
      - C:\Users\Admin\Documents\3q0Bh4DqOaNaYe8HmItUyS1G.exe
        
        "C:\Users\Admin\Documents\3q0Bh4DqOaNaYe8HmItUyS1G.exe"
        6⤵
        
        PID:2100
      - C:\Users\Admin\Documents\RN1tLL0_jT36ey_PW0xSPXom.exe
        
        "C:\Users\Admin\Documents\RN1tLL0_jT36ey_PW0xSPXom.exe"
        6⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Roaming\4325944.exe
        
        "C:\Users\Admin\AppData\Roaming\4325944.exe"
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Roaming\3250782.exe
        
        "C:\Users\Admin\AppData\Roaming\3250782.exe"
        7⤵
        
        PID:4052
      - C:\Users\Admin\Documents\0CFNpJS4Kgdact5W5zV0SpSk.exe
        
        "C:\Users\Admin\Documents\0CFNpJS4Kgdact5W5zV0SpSk.exe"
        6⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Roaming\7451847.exe
        
        "C:\Users\Admin\AppData\Roaming\7451847.exe"
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Roaming\2170681.exe
        
        "C:\Users\Admin\AppData\Roaming\2170681.exe"
        7⤵
        
        PID:3632

C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\e9e6055abb695524.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8E663F64\e9e6055abb695524.exe" -a
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:2184

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2240

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:3664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-172-0x0000000003770000-0x000000000380D000-memory.dmp

Download

memory/572-173-0x0000000000400000-0x000000000334B000-memory.dmp

Download

memory/748-90-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/748-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/748-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/748-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/748-93-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/748-95-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/748-98-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/748-103-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/748-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/748-97-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/860-341-0x0000000000AC0000-0x0000000000B0D000-memory.dmp

Download

memory/860-342-0x00000000018C0000-0x0000000001934000-memory.dmp

Download

memory/860-189-0x0000000001690000-0x0000000001704000-memory.dmp

Download

memory/860-188-0x00000000009A0000-0x00000000009ED000-memory.dmp

Download

memory/912-161-0x0000000000250000-0x0000000000251000-memory.dmp

Download

memory/912-171-0x000000001AF90000-0x000000001AF92000-memory.dmp

Download

memory/912-165-0x0000000000260000-0x000000000027C000-memory.dmp

Download

memory/912-167-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/912-133-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/1256-297-0x0000000002BB0000-0x0000000002BC6000-memory.dmp

Download

memory/1256-397-0x0000000003A60000-0x0000000003A76000-memory.dmp

Download

memory/1412-176-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/1412-174-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/1452-276-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/1736-164-0x000000001B020000-0x000000001B022000-memory.dmp

Download

memory/1736-145-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/1916-350-0x0000000000400000-0x0000000000D41000-memory.dmp

Download

memory/1916-349-0x0000000002E20000-0x0000000003746000-memory.dmp

Download

memory/2028-60-0x00000000765F1000-0x00000000765F3000-memory.dmp

Download

memory/2064-406-0x0000000000440000-0x0000000000442000-memory.dmp

Download

memory/2100-334-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/2176-236-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2184-187-0x00000000004C0000-0x000000000051F000-memory.dmp

Download

memory/2184-186-0x00000000009B0000-0x0000000000AB1000-memory.dmp

Download

memory/2188-336-0x000000001AFD0000-0x000000001AFD2000-memory.dmp

Download

memory/2240-248-0x00000000002F0000-0x000000000030B000-memory.dmp

Download

memory/2240-244-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

Download

memory/2240-190-0x0000000000250000-0x00000000002C4000-memory.dmp

Download

memory/2240-252-0x00000000030E0000-0x00000000031E6000-memory.dmp

Download

memory/2312-193-0x0000000000300000-0x0000000000301000-memory.dmp

Download

memory/2328-386-0x0000000000400000-0x00000000032F8000-memory.dmp

Download

memory/2328-381-0x0000000000240000-0x0000000000249000-memory.dmp

Download

memory/2352-206-0x0000000000350000-0x0000000000352000-memory.dmp

Download

memory/2352-196-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2352-198-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2360-329-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/2424-316-0x000000001B1B0000-0x000000001B1B2000-memory.dmp

Download

memory/2496-322-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/2500-355-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/2520-200-0x000000013F5C0000-0x000000013F5C1000-memory.dmp

Download

memory/2520-255-0x000000001BE10000-0x000000001BE12000-memory.dmp

Download

memory/2600-321-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/2656-210-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/2656-217-0x000000001AA60000-0x000000001AA62000-memory.dmp

Download

memory/2672-212-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2788-278-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/2920-256-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

Download

memory/2920-233-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/2944-257-0x00000000002E0000-0x00000000002E2000-memory.dmp

Download

memory/2944-230-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/2952-242-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/2952-261-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/2968-250-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/2968-234-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/2980-246-0x0000000000250000-0x000000000025A000-memory.dmp

Download

memory/3016-249-0x0000000001280000-0x0000000001281000-memory.dmp

Download

memory/3016-274-0x0000000004C80000-0x0000000004C81000-memory.dmp

Download

memory/3040-365-0x0000000002300000-0x0000000002302000-memory.dmp

Download

memory/3284-340-0x00000000033F0000-0x00000000034BF000-memory.dmp

Download

memory/3284-338-0x0000000001F10000-0x0000000001F7E000-memory.dmp

Download

memory/3316-346-0x0000000000400000-0x000000000067D000-memory.dmp

Download

memory/3528-370-0x000000001BCE0000-0x000000001BCE2000-memory.dmp

Download

memory/3632-402-0x00000000048D0000-0x00000000048D1000-memory.dmp

Download

memory/3664-344-0x0000000000470000-0x00000000004CF000-memory.dmp

Download

memory/3664-343-0x00000000020B0000-0x00000000021B1000-memory.dmp

Download

memory/3768-376-0x000000001AFF0000-0x000000001AFF2000-memory.dmp

Download

memory/3864-359-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/4000-404-0x00000000048C0000-0x00000000048C1000-memory.dmp

Download

memory/4052-360-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads