raccoon | 0192b858039b3182dfd17ce582c9398dc1495566082de0f6a76279585bacf8e5

General

Target

6fe5bd5873aaaeb6ac65b0c36857e51d.exe
Size

181KB
MD5

6fe5bd5873aaaeb6ac65b0c36857e51d
SHA1

0c2ee10d505b91e60bea89fb5bb8ba54768fec1f
SHA256

0192b858039b3182dfd17ce582c9398dc1495566082de0f6a76279585bacf8e5
SHA512

7d02b77b41cfb2923a4444a119c9cb4e97804198e08a3a66dc4562a33f91e9cadb5a41bf4d33ad13a1e5154089d4d104de868ac6711889f6b8921273217412eb

Score

10^/10

raccoon redline smokeloader cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes

url4cnc
https://telete.in/jagressor_kz

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1936-143-0x00000000049D0000-0x0000000004A61000-memory.dmp	family_raccoon
behavioral2/memory/1936-146-0x0000000000400000-0x0000000002D05000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\275F.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\275F.exe	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3776 created 1936 3776 WerFault.exe 3105.exe
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

275F.exe3105.exe

pid process

3604 275F.exe
1936 3105.exe

description	pid	process	target process
PID 3776 created 1936	3776	WerFault.exe	3105.exe

pid	process
3604	275F.exe
1936	3105.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

275F.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	275F.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	275F.exe

Deletes itself 1 IoCs

Processes:

pid process

2716
Loads dropped DLL 1 IoCs

Processes:

3105.exe

pid process

1936 3105.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2716

pid	process
1936	3105.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\275F.exe	themida
C:\Users\Admin\AppData\Local\Temp\275F.exe	themida
behavioral2/memory/3604-121-0x0000000000E60000-0x0000000000E61000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

275F.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 275F.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

275F.exe

pid process

3604 275F.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

6fe5bd5873aaaeb6ac65b0c36857e51d.exe

description pid process target process

PID 752 set thread context of 2148 752 6fe5bd5873aaaeb6ac65b0c36857e51d.exe 6fe5bd5873aaaeb6ac65b0c36857e51d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	275F.exe

pid	process
3604	275F.exe

description	pid	process	target process
PID 752 set thread context of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe

Program crash 32 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2272	1936	WerFault.exe	3105.exe
3036	1936	WerFault.exe	3105.exe
188	1936	WerFault.exe	3105.exe
3224	1936	WerFault.exe	3105.exe
2284	1936	WerFault.exe	3105.exe
2240	1936	WerFault.exe	3105.exe
3812	1936	WerFault.exe	3105.exe
3508	1936	WerFault.exe	3105.exe
840	1936	WerFault.exe	3105.exe
1588	1936	WerFault.exe	3105.exe
3988	1936	WerFault.exe	3105.exe
4052	1936	WerFault.exe	3105.exe
1612	1936	WerFault.exe	3105.exe
1496	1936	WerFault.exe	3105.exe
3900	1936	WerFault.exe	3105.exe
1784	1936	WerFault.exe	3105.exe
1492	1936	WerFault.exe	3105.exe
2536	1936	WerFault.exe	3105.exe
1676	1936	WerFault.exe	3105.exe
1260	1936	WerFault.exe	3105.exe
1864	1936	WerFault.exe	3105.exe
2256	1936	WerFault.exe	3105.exe
2316	1936	WerFault.exe	3105.exe
2228	1936	WerFault.exe	3105.exe
1004	1936	WerFault.exe	3105.exe
1896	1936	WerFault.exe	3105.exe
1664	1936	WerFault.exe	3105.exe
856	1936	WerFault.exe	3105.exe
3128	1936	WerFault.exe	3105.exe
1280	1936	WerFault.exe	3105.exe
1632	1936	WerFault.exe	3105.exe
3776	1936	WerFault.exe	3105.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

6fe5bd5873aaaeb6ac65b0c36857e51d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	6fe5bd5873aaaeb6ac65b0c36857e51d.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6fe5bd5873aaaeb6ac65b0c36857e51d.exe

pid	process
2148	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
2148	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2716
Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

6fe5bd5873aaaeb6ac65b0c36857e51d.exe

pid process

2148 6fe5bd5873aaaeb6ac65b0c36857e51d.exe
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716
2716

pid	process
2716

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

275F.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

description	pid	process
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeDebugPrivilege	3604	275F.exe
Token: SeRestorePrivilege	2272	WerFault.exe
Token: SeBackupPrivilege	2272	WerFault.exe
Token: SeDebugPrivilege	2272	WerFault.exe
Token: SeDebugPrivilege	3036	WerFault.exe
Token: SeDebugPrivilege	188	WerFault.exe
Token: SeDebugPrivilege	3224	WerFault.exe
Token: SeDebugPrivilege	2284	WerFault.exe
Token: SeDebugPrivilege	2240	WerFault.exe
Token: SeDebugPrivilege	3812	WerFault.exe
Token: SeDebugPrivilege	3508	WerFault.exe
Token: SeDebugPrivilege	840	WerFault.exe
Token: SeDebugPrivilege	1588	WerFault.exe
Token: SeDebugPrivilege	3988	WerFault.exe
Token: SeDebugPrivilege	4052	WerFault.exe
Token: SeDebugPrivilege	1612	WerFault.exe
Token: SeDebugPrivilege	1496	WerFault.exe
Token: SeDebugPrivilege	3900	WerFault.exe
Token: SeDebugPrivilege	1784	WerFault.exe
Token: SeDebugPrivilege	1492	WerFault.exe
Token: SeDebugPrivilege	2536	WerFault.exe
Token: SeDebugPrivilege	1676	WerFault.exe
Token: SeDebugPrivilege	1260	WerFault.exe
Token: SeDebugPrivilege	1864	WerFault.exe
Token: SeDebugPrivilege	2256	WerFault.exe
Token: SeDebugPrivilege	2316	WerFault.exe
Token: SeDebugPrivilege	2228	WerFault.exe
Token: SeDebugPrivilege	1004	WerFault.exe
Token: SeDebugPrivilege	1896	WerFault.exe
Token: SeDebugPrivilege	1664	WerFault.exe
Token: SeDebugPrivilege	856	WerFault.exe
Token: SeDebugPrivilege	3128	WerFault.exe
Token: SeDebugPrivilege	1280	WerFault.exe
Token: SeDebugPrivilege	1632	WerFault.exe
Token: SeDebugPrivilege	3776	WerFault.exe
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716
Token: SeShutdownPrivilege	2716
Token: SeCreatePagefilePrivilege	2716

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2716

pid	process
2716

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

6fe5bd5873aaaeb6ac65b0c36857e51d.exe

description	pid	process	target process
PID 752 wrote to memory of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
PID 752 wrote to memory of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
PID 752 wrote to memory of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
PID 752 wrote to memory of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
PID 752 wrote to memory of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
PID 752 wrote to memory of 2148	752	6fe5bd5873aaaeb6ac65b0c36857e51d.exe	6fe5bd5873aaaeb6ac65b0c36857e51d.exe
PID 2716 wrote to memory of 3604	2716		275F.exe
PID 2716 wrote to memory of 3604	2716		275F.exe
PID 2716 wrote to memory of 3604	2716		275F.exe
PID 2716 wrote to memory of 1936	2716		3105.exe
PID 2716 wrote to memory of 1936	2716		3105.exe
PID 2716 wrote to memory of 1936	2716		3105.exe
PID 2716 wrote to memory of 3524	2716		explorer.exe
PID 2716 wrote to memory of 3524	2716		explorer.exe
PID 2716 wrote to memory of 3524	2716		explorer.exe
PID 2716 wrote to memory of 3524	2716		explorer.exe
PID 2716 wrote to memory of 3896	2716		explorer.exe
PID 2716 wrote to memory of 3896	2716		explorer.exe
PID 2716 wrote to memory of 3896	2716		explorer.exe
PID 2716 wrote to memory of 2196	2716		explorer.exe
PID 2716 wrote to memory of 2196	2716		explorer.exe
PID 2716 wrote to memory of 2196	2716		explorer.exe
PID 2716 wrote to memory of 2196	2716		explorer.exe
PID 2716 wrote to memory of 2576	2716		explorer.exe
PID 2716 wrote to memory of 2576	2716		explorer.exe
PID 2716 wrote to memory of 2576	2716		explorer.exe
PID 2716 wrote to memory of 2840	2716		explorer.exe
PID 2716 wrote to memory of 2840	2716		explorer.exe
PID 2716 wrote to memory of 2840	2716		explorer.exe
PID 2716 wrote to memory of 2840	2716		explorer.exe
PID 2716 wrote to memory of 2216	2716		explorer.exe
PID 2716 wrote to memory of 2216	2716		explorer.exe
PID 2716 wrote to memory of 2216	2716		explorer.exe
PID 2716 wrote to memory of 860	2716		explorer.exe
PID 2716 wrote to memory of 860	2716		explorer.exe
PID 2716 wrote to memory of 860	2716		explorer.exe
PID 2716 wrote to memory of 860	2716		explorer.exe
PID 2716 wrote to memory of 352	2716		explorer.exe
PID 2716 wrote to memory of 352	2716		explorer.exe
PID 2716 wrote to memory of 352	2716		explorer.exe
PID 2716 wrote to memory of 3772	2716		explorer.exe
PID 2716 wrote to memory of 3772	2716		explorer.exe
PID 2716 wrote to memory of 3772	2716		explorer.exe
PID 2716 wrote to memory of 3772	2716		explorer.exe

C:\Users\Admin\AppData\Local\Temp\6fe5bd5873aaaeb6ac65b0c36857e51d.exe
"C:\Users\Admin\AppData\Local\Temp\6fe5bd5873aaaeb6ac65b0c36857e51d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\6fe5bd5873aaaeb6ac65b0c36857e51d.exe
"C:\Users\Admin\AppData\Local\Temp\6fe5bd5873aaaeb6ac65b0c36857e51d.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2148

C:\Users\Admin\AppData\Local\Temp\275F.exe
C:\Users\Admin\AppData\Local\Temp\275F.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Users\Admin\AppData\Local\Temp\3105.exe
C:\Users\Admin\AppData\Local\Temp\3105.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 736
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 752
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 756
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 844
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1188
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1228
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1328
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1252
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1200
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1324
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1436
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1276
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1348
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1296
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1248
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1244
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1208
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1436
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1332
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1436
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1284
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1112
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1272
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1168
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1232
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1244
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1180
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1168
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1340
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1468
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1180
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 1492
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3524

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3896

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2196

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2576

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2840

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2216

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:860

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:352

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\275F.exe
MD5
fa2170ab2dfa330d961cccf8e93c757b

SHA1
d3fd7ae0be7954a547169e29a44d467f14dfb340

SHA256
78f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0

SHA512
3880238681560639c153492eaf4a06fc738fed56e6cf3fb64ccd15f47046d04dccae17ff541a5eb32724b7af2a231169dc7c879eea54d2781fbc7429c1bedd4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\275F.exe
MD5
fa2170ab2dfa330d961cccf8e93c757b

SHA1
d3fd7ae0be7954a547169e29a44d467f14dfb340

SHA256
78f4272d2904fd5539aa41955c99968e0971e167a5d9b42389e9a51ab79cf1b0

SHA512
3880238681560639c153492eaf4a06fc738fed56e6cf3fb64ccd15f47046d04dccae17ff541a5eb32724b7af2a231169dc7c879eea54d2781fbc7429c1bedd4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3105.exe
MD5
2ee47cb260a230ec5bdf2aa462d768a0

SHA1
ffe9d53d277b60bc7e50fc73006459fbc3f42430

SHA256
de64482ad4cb75780ba049d805ebee7dc559b0611610b6ab2f3071b49d1d5e8f

SHA512
94807808a1ef30c39de33337883326648d7faebb2752516ae1ba3f7aaa3a44abcc0bf2ee2238e123e8e917aad9935671968bca29d2d4b6cd19d1fc07b7cba88f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3105.exe
MD5
2ee47cb260a230ec5bdf2aa462d768a0

SHA1
ffe9d53d277b60bc7e50fc73006459fbc3f42430

SHA256
de64482ad4cb75780ba049d805ebee7dc559b0611610b6ab2f3071b49d1d5e8f

SHA512
94807808a1ef30c39de33337883326648d7faebb2752516ae1ba3f7aaa3a44abcc0bf2ee2238e123e8e917aad9935671968bca29d2d4b6cd19d1fc07b7cba88f

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/352-156-0x0000000000000000-mapping.dmp

Download
memory/352-158-0x00000000003D0000-0x00000000003D9000-memory.dmp

Filesize
36KB

Download
memory/352-157-0x00000000003E0000-0x00000000003E5000-memory.dmp

Filesize
20KB

Download
memory/752-114-0x0000000002CC0000-0x0000000002E0A000-memory.dmp

Filesize
1.3MB

Download
memory/860-155-0x00000000005D0000-0x00000000005D9000-memory.dmp

Filesize
36KB

Download
memory/860-154-0x00000000005E0000-0x00000000005E4000-memory.dmp

Filesize
16KB

Download
memory/860-153-0x0000000000000000-mapping.dmp

Download
memory/1936-146-0x0000000000400000-0x0000000002D05000-memory.dmp

Filesize
41.0MB

Download
memory/1936-143-0x00000000049D0000-0x0000000004A61000-memory.dmp

Filesize
580KB

Download
memory/1936-130-0x0000000000000000-mapping.dmp

Download
memory/2148-116-0x0000000000402E1A-mapping.dmp

Download
memory/2148-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2196-141-0x0000000000AF0000-0x0000000000AFB000-memory.dmp

Filesize
44KB

Download
memory/2196-139-0x0000000000000000-mapping.dmp

Download
memory/2196-140-0x0000000000B00000-0x0000000000B07000-memory.dmp

Filesize
28KB

Download
memory/2216-152-0x00000000001C0000-0x00000000001CC000-memory.dmp

Filesize
48KB

Download
memory/2216-151-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2216-150-0x0000000000000000-mapping.dmp

Download
memory/2576-142-0x0000000000000000-mapping.dmp

Download
memory/2576-144-0x0000000000A80000-0x0000000000A89000-memory.dmp

Filesize
36KB

Download
memory/2576-145-0x00000000007F0000-0x00000000007FF000-memory.dmp

Filesize
60KB

Download
memory/2716-117-0x0000000000EF0000-0x0000000000F06000-memory.dmp

Filesize
88KB

Download
memory/2840-148-0x00000000006C0000-0x00000000006C5000-memory.dmp

Filesize
20KB

Download
memory/2840-149-0x00000000006B0000-0x00000000006B9000-memory.dmp

Filesize
36KB

Download
memory/2840-147-0x0000000000000000-mapping.dmp

Download
memory/3524-134-0x0000000003740000-0x00000000037B4000-memory.dmp

Filesize
464KB

Download
memory/3524-133-0x0000000000000000-mapping.dmp

Download
memory/3524-135-0x00000000036D0000-0x000000000373B000-memory.dmp

Filesize
428KB

Download
memory/3604-127-0x0000000005B50000-0x0000000005B51000-memory.dmp

Filesize
4KB

Download
memory/3604-164-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/3604-169-0x0000000007630000-0x0000000007631000-memory.dmp

Filesize
4KB

Download
memory/3604-128-0x0000000005D70000-0x0000000005D71000-memory.dmp

Filesize
4KB

Download
memory/3604-129-0x0000000005C50000-0x0000000005C51000-memory.dmp

Filesize
4KB

Download
memory/3604-126-0x0000000005B10000-0x0000000005B11000-memory.dmp

Filesize
4KB

Download
memory/3604-125-0x0000000005AB0000-0x0000000005AB1000-memory.dmp

Filesize
4KB

Download
memory/3604-124-0x0000000006270000-0x0000000006271000-memory.dmp

Filesize
4KB

Download
memory/3604-123-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/3604-121-0x0000000000E60000-0x0000000000E61000-memory.dmp

Filesize
4KB

Download
memory/3604-118-0x0000000000000000-mapping.dmp

Download
memory/3604-168-0x0000000007590000-0x0000000007591000-memory.dmp

Filesize
4KB

Download
memory/3604-167-0x0000000007470000-0x0000000007471000-memory.dmp

Filesize
4KB

Download
memory/3604-166-0x00000000080B0000-0x00000000080B1000-memory.dmp

Filesize
4KB

Download
memory/3604-165-0x00000000071C0000-0x00000000071C1000-memory.dmp

Filesize
4KB

Download
memory/3604-163-0x0000000006F80000-0x0000000006F81000-memory.dmp

Filesize
4KB

Download
memory/3772-162-0x0000000000350000-0x0000000000359000-memory.dmp

Filesize
36KB

Download
memory/3772-161-0x0000000000360000-0x0000000000365000-memory.dmp

Filesize
20KB

Download
memory/3772-159-0x0000000000000000-mapping.dmp

Download
memory/3896-137-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download
memory/3896-138-0x0000000000120000-0x000000000012C000-memory.dmp

Filesize
48KB

Download
memory/3896-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads