Analysis
- max time kernel
21s - max time network
154s - platform
windows10_x64 - resource
win10v20210408 - submitted
13/08/2021, 18:11
General
- Target 0B6B2968E8F090B22BC47ABAB70C4DD0.exe
- Size 5.7MB
- Sample210813-xew4hd2n4e
- SHA256 cf8a60b5e39660a02d37d4d5f1d28e392427c1da05142d4a651cd1c267d07cc1
Malware Config
Extracted
-
vidar
-
40
-
706
-
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Extracted
-
raccoon
-
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Extracted
-
vidar
-
40
-
937
-
https://lenak513.tumblr.com/
-
profile_id
937
Extracted
-
vidar
-
40
-
916
-
https://lenak513.tumblr.com/
-
profile_id
916
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars Payload 2 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
- suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Vidar Stealer 4 IoCs
- ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
- Downloads MZ/PE file
- Executes dropped EXE 27 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 15 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Kills process with taskkill 2 IoCs
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0B6B2968E8F090B22BC47ABAB70C4DD0.exe"C:\Users\Admin\AppData\Local\Temp\0B6B2968E8F090B22BC47ABAB70C4DD0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 27ce46284501.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\27ce46284501.exe27ce46284501.exe5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 20383e5a9a4c5112.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\20383e5a9a4c5112.exe20383e5a9a4c5112.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\8936992.exe"C:\Users\Admin\AppData\Roaming\8936992.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\4644853.exe"C:\Users\Admin\AppData\Roaming\4644853.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\7322682.exe"C:\Users\Admin\AppData\Roaming\7322682.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\1914191.exe"C:\Users\Admin\AppData\Roaming\1914191.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\3894379.exe"C:\Users\Admin\AppData\Roaming\3894379.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c e9e6055abb695524.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\e9e6055abb695524.exee9e6055abb695524.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\e9e6055abb695524.exe"C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\e9e6055abb695524.exe" -a6⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 3d0c613fcb2403.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\3d0c613fcb2403.exe3d0c613fcb2403.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c f9a302645.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\f9a302645.exef9a302645.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2d7080268fee447.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\2d7080268fee447.exe2d7080268fee447.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe9⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4432 -s 15288⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"C:\Users\Admin\AppData\Local\Temp\NGlorySetp.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\5316223.exe"C:\Users\Admin\AppData\Roaming\5316223.exe"8⤵
-
-
C:\Users\Admin\AppData\Roaming\4986780.exe"C:\Users\Admin\AppData\Roaming\4986780.exe"8⤵
-
-
C:\Users\Admin\AppData\Roaming\2003603.exe"C:\Users\Admin\AppData\Roaming\2003603.exe"8⤵
-
-
C:\Users\Admin\AppData\Roaming\2422314.exe"C:\Users\Admin\AppData\Roaming\2422314.exe"8⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 8008⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 8408⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 8728⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 11408⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 11488⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c b001a8f56.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\b001a8f56.exeb001a8f56.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 14846⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 79d822fc709e78.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS00D6E0B4\79d822fc709e78.exe79d822fc709e78.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\kH5ePwOsdMbH3AOYXg8fyRQg.exe"C:\Users\Admin\Documents\kH5ePwOsdMbH3AOYXg8fyRQg.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com8⤵
-
-
-
-
C:\Users\Admin\Documents\yku0dSo693AktdGZblVQxBq_.exe"C:\Users\Admin\Documents\yku0dSo693AktdGZblVQxBq_.exe"6⤵
-
-
C:\Users\Admin\Documents\saBPfYthRaSm3O2paSi7ySeF.exe"C:\Users\Admin\Documents\saBPfYthRaSm3O2paSi7ySeF.exe"6⤵
-
-
C:\Users\Admin\Documents\oxerBBHjDEdVn26TUBuseHjO.exe"C:\Users\Admin\Documents\oxerBBHjDEdVn26TUBuseHjO.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
-
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"8⤵
-
-
-
-
C:\Users\Admin\Documents\zPlhGcSVxR_fHlse4rZ7N84t.exe"C:\Users\Admin\Documents\zPlhGcSVxR_fHlse4rZ7N84t.exe"6⤵
-
C:\Users\Admin\Documents\zPlhGcSVxR_fHlse4rZ7N84t.exeC:\Users\Admin\Documents\zPlhGcSVxR_fHlse4rZ7N84t.exe7⤵
-
-
-
C:\Users\Admin\Documents\WmfF_lmMS0UY0BaOyc0YTUNy.exe"C:\Users\Admin\Documents\WmfF_lmMS0UY0BaOyc0YTUNy.exe"6⤵
-
-
C:\Users\Admin\Documents\ONGIew4udtQaTgt1Yubc_6AY.exe"C:\Users\Admin\Documents\ONGIew4udtQaTgt1Yubc_6AY.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 7367⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 7407⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 8527⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\zndvLiYfyJZ3eDuAyffk2uon.exe"C:\Users\Admin\Documents\zndvLiYfyJZ3eDuAyffk2uon.exe"6⤵
-
-
C:\Users\Admin\Documents\3fOQ1kpZCty63B1DeazPW45Y.exe"C:\Users\Admin\Documents\3fOQ1kpZCty63B1DeazPW45Y.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 6567⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 6367⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3fOQ1kpZCty63B1DeazPW45Y.exe" /f & erase "C:\Users\Admin\Documents\3fOQ1kpZCty63B1DeazPW45Y.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3fOQ1kpZCty63B1DeazPW45Y.exe" /f8⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\Documents\2gccZGIc8aEadZqnq74Sot8o.exe"C:\Users\Admin\Documents\2gccZGIc8aEadZqnq74Sot8o.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\Documents\RoQOoJ1dZB29_TQJelv9ud_o.exe"C:\Users\Admin\Documents\RoQOoJ1dZB29_TQJelv9ud_o.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\5843358.exe"C:\Users\Admin\AppData\Roaming\5843358.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\2790513.exe"C:\Users\Admin\AppData\Roaming\2790513.exe"7⤵
-
-
-
C:\Users\Admin\Documents\OrqnpgGIjPuZ_FYCFzc_DD8c.exe"C:\Users\Admin\Documents\OrqnpgGIjPuZ_FYCFzc_DD8c.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\2999334.exe"C:\Users\Admin\AppData\Roaming\2999334.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\5346653.exe"C:\Users\Admin\AppData\Roaming\5346653.exe"7⤵
-
-
-
C:\Users\Admin\Documents\FrIbTNB29mtYgiqr41eBKxLt.exe"C:\Users\Admin\Documents\FrIbTNB29mtYgiqr41eBKxLt.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 6527⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 6727⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 6847⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\9uz1B2xLctvbzznPvcaNsC7l.exe"C:\Users\Admin\Documents\9uz1B2xLctvbzznPvcaNsC7l.exe"6⤵
-
-
C:\Users\Admin\Documents\6o3FSdOywsMcNAPVU3VmCBIP.exe"C:\Users\Admin\Documents\6o3FSdOywsMcNAPVU3VmCBIP.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
-
C:\Users\Admin\Documents\GGlMsrGqVBmGOVQ3UHsMcsQ1.exe"C:\Users\Admin\Documents\GGlMsrGqVBmGOVQ3UHsMcsQ1.exe"6⤵
-
C:\Users\Admin\Documents\GGlMsrGqVBmGOVQ3UHsMcsQ1.exe"C:\Users\Admin\Documents\GGlMsrGqVBmGOVQ3UHsMcsQ1.exe"7⤵
-
-
-
C:\Users\Admin\Documents\Yb_ahIRZDA36D1l26WdlbYTw.exe"C:\Users\Admin\Documents\Yb_ahIRZDA36D1l26WdlbYTw.exe"6⤵
-
-
C:\Users\Admin\Documents\4APOVmTM4CrAj2BPvdURjuFd.exe"C:\Users\Admin\Documents\4APOVmTM4CrAj2BPvdURjuFd.exe"6⤵
-
-
C:\Users\Admin\Documents\63lT_jN1OWcQFsWS1dWPI7mu.exe"C:\Users\Admin\Documents\63lT_jN1OWcQFsWS1dWPI7mu.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1333445.exe"C:\Users\Admin\AppData\Roaming\1333445.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\3313633.exe"C:\Users\Admin\AppData\Roaming\3313633.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\2197282.exe"C:\Users\Admin\AppData\Roaming\2197282.exe"7⤵
-
-
C:\Users\Admin\AppData\Roaming\1856566.exe"C:\Users\Admin\AppData\Roaming\1856566.exe"7⤵
-
-
-
C:\Users\Admin\Documents\L7ZPXGv7YmrqphTLPveJ9crM.exe"C:\Users\Admin\Documents\L7ZPXGv7YmrqphTLPveJ9crM.exe"6⤵
-
-
C:\Users\Admin\Documents\pNlzu9nloABGLxxZqXLV8dbL.exe"C:\Users\Admin\Documents\pNlzu9nloABGLxxZqXLV8dbL.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsyBB6.tmp\tempfile.ps1"7⤵
-
-
-
C:\Users\Admin\Documents\QySnFXOH1m8CyR2b8G0j7JW5.exe"C:\Users\Admin\Documents\QySnFXOH1m8CyR2b8G0j7JW5.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HE69V.tmp\QySnFXOH1m8CyR2b8G0j7JW5.tmp"C:\Users\Admin\AppData\Local\Temp\is-HE69V.tmp\QySnFXOH1m8CyR2b8G0j7JW5.tmp" /SL5="$70068,138429,56832,C:\Users\Admin\Documents\QySnFXOH1m8CyR2b8G0j7JW5.exe"7⤵
-
-
-
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Users\Admin\AppData\Local\Temp\AB4F.exeC:\Users\Admin\AppData\Local\Temp\AB4F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B023.exeC:\Users\Admin\AppData\Local\Temp\B023.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Disabling Security Tools
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/340-356-0x000002513E990000-0x000002513EA04000-memory.dmp
memory/344-179-0x000000001B620000-0x000000001B622000-memory.dmp
memory/344-174-0x0000000002850000-0x0000000002851000-memory.dmp
memory/344-171-0x0000000000980000-0x0000000000981000-memory.dmp
memory/344-175-0x0000000002860000-0x000000000287C000-memory.dmp
memory/344-176-0x0000000002880000-0x0000000002881000-memory.dmp
memory/972-408-0x0000000002E00000-0x0000000002E01000-memory.dmp
memory/972-361-0x0000000077D90000-0x0000000077F1E000-memory.dmp
memory/972-194-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/1040-401-0x000001C69AD00000-0x000001C69AD74000-memory.dmp
memory/1092-405-0x000001FEFEE70000-0x000001FEFEEE4000-memory.dmp
memory/1104-325-0x000001DCA5AE0000-0x000001DCA5B2D000-memory.dmp
memory/1104-332-0x000001DCA5BA0000-0x000001DCA5C14000-memory.dmp
memory/1248-431-0x000001C40A440000-0x000001C40A4B4000-memory.dmp
memory/1424-413-0x000001AE08F60000-0x000001AE08FD4000-memory.dmp
memory/1864-187-0x0000000000030000-0x0000000000039000-memory.dmp
memory/1864-189-0x0000000000400000-0x00000000032F8000-memory.dmp
memory/1960-420-0x0000020D5D6D0000-0x0000020D5D744000-memory.dmp
memory/2180-370-0x0000000004760000-0x0000000004790000-memory.dmp
memory/2180-390-0x0000000000400000-0x0000000002C75000-memory.dmp
memory/2248-226-0x0000000007E60000-0x0000000007E61000-memory.dmp
memory/2248-240-0x0000000007A40000-0x0000000007A41000-memory.dmp
memory/2248-220-0x0000000001390000-0x0000000001397000-memory.dmp
memory/2248-207-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/2396-368-0x00000157A75A0000-0x00000157A7614000-memory.dmp
memory/2412-384-0x0000026594C40000-0x0000026594CB4000-memory.dmp
memory/3060-277-0x00000000013F0000-0x0000000001406000-memory.dmp
memory/3168-314-0x0000000000E80000-0x0000000000FCA000-memory.dmp
memory/3168-317-0x0000000000E80000-0x0000000000FCA000-memory.dmp
memory/3272-133-0x0000000064940000-0x0000000064959000-memory.dmp
memory/3272-134-0x0000000064940000-0x0000000064959000-memory.dmp
memory/3272-138-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/3272-132-0x0000000064940000-0x0000000064959000-memory.dmp
memory/3272-135-0x0000000064940000-0x0000000064959000-memory.dmp
memory/3272-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/3272-136-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/3304-161-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/3304-173-0x000000001BA50000-0x000000001BA52000-memory.dmp
memory/3492-354-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/3624-337-0x0000000004980000-0x0000000004A1D000-memory.dmp
memory/3624-358-0x0000000000400000-0x0000000002D16000-memory.dmp
memory/3656-212-0x0000000000EA0000-0x0000000000ECB000-memory.dmp
memory/3656-243-0x0000000000F40000-0x0000000000F42000-memory.dmp
memory/3656-200-0x0000000000860000-0x0000000000861000-memory.dmp
memory/3660-349-0x0000000004950000-0x00000000049E2000-memory.dmp
memory/3768-178-0x0000000077D90000-0x0000000077F1E000-memory.dmp
memory/3768-239-0x0000000005720000-0x0000000005721000-memory.dmp
memory/3768-196-0x0000000005660000-0x0000000005661000-memory.dmp
memory/3768-190-0x0000000005600000-0x0000000005601000-memory.dmp
memory/3768-225-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/3768-180-0x00000000013C0000-0x00000000013C1000-memory.dmp
memory/3768-185-0x0000000005D40000-0x0000000005D41000-memory.dmp
memory/3768-251-0x0000000005860000-0x0000000005861000-memory.dmp
memory/3860-211-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/3860-310-0x0000000000E00000-0x0000000000E0A000-memory.dmp
memory/3860-320-0x0000000002B70000-0x0000000002B72000-memory.dmp
memory/3920-306-0x0000000007790000-0x0000000007791000-memory.dmp
memory/3920-303-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/3948-248-0x000001D535C80000-0x000001D535E1B000-memory.dmp
memory/3948-247-0x000001D535A00000-0x000001D535AD7000-memory.dmp
memory/4072-186-0x0000000003350000-0x000000000349A000-memory.dmp
memory/4072-188-0x0000000000400000-0x000000000334B000-memory.dmp
memory/4100-232-0x00000000002E0000-0x00000000002E1000-memory.dmp
memory/4100-249-0x0000000002570000-0x00000000025A2000-memory.dmp
memory/4100-264-0x0000000004C90000-0x0000000004C91000-memory.dmp
memory/4148-289-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/4148-296-0x0000000005270000-0x0000000005271000-memory.dmp
memory/4196-265-0x0000000004960000-0x0000000004961000-memory.dmp
memory/4196-254-0x0000000004890000-0x00000000048C2000-memory.dmp
memory/4196-244-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/4216-346-0x0000000004930000-0x00000000049BF000-memory.dmp
memory/4216-364-0x0000000000400000-0x0000000002D01000-memory.dmp
memory/4308-253-0x0000000001400000-0x000000000142A000-memory.dmp
memory/4308-231-0x0000000000D00000-0x0000000000D01000-memory.dmp
memory/4308-242-0x0000000005690000-0x0000000005691000-memory.dmp
memory/4348-379-0x0000000004EF0000-0x0000000004F4F000-memory.dmp
memory/4348-374-0x0000000004DE6000-0x0000000004EE7000-memory.dmp
memory/4432-238-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/4432-245-0x000000001B1E0000-0x000000001B1E2000-memory.dmp
memory/4536-341-0x000000001B6A0000-0x000000001B6A2000-memory.dmp
memory/4672-347-0x000000001B910000-0x000000001B912000-memory.dmp
memory/4684-428-0x000001ACF5350000-0x000001ACF541F000-memory.dmp
memory/4684-425-0x000001ACF52E0000-0x000001ACF534F000-memory.dmp
memory/4932-271-0x0000000000780000-0x0000000000781000-memory.dmp
memory/4932-275-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/4932-273-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
memory/4932-274-0x0000000000EB0000-0x0000000000ECD000-memory.dmp
memory/4932-278-0x000000001B3C0000-0x000000001B3C2000-memory.dmp
memory/4996-394-0x0000000000400000-0x000000000090F000-memory.dmp
memory/4996-388-0x00000000001C0000-0x00000000001EF000-memory.dmp
memory/5028-330-0x00000000001D0000-0x00000000001FE000-memory.dmp
memory/5204-411-0x0000000077D90000-0x0000000077F1E000-memory.dmp
memory/5240-382-0x0000000000D20000-0x0000000000D22000-memory.dmp
memory/5288-392-0x0000000002E60000-0x0000000002E62000-memory.dmp
memory/5332-417-0x0000000077D90000-0x0000000077F1E000-memory.dmp
memory/5384-397-0x0000000002E50000-0x0000000002F9A000-memory.dmp
memory/5384-415-0x0000000000400000-0x0000000002D16000-memory.dmp
memory/5492-399-0x0000000006910000-0x0000000006911000-memory.dmp
memory/5600-402-0x0000000002D10000-0x0000000002D1A000-memory.dmp
memory/5944-422-0x0000000000400000-0x0000000000409000-memory.dmp