raccoon | ce2fe316faac707fdef9aed79c1eb348f74a538fb5617ceea0a003b964c146e4

Analysis

max time kernel
157s
max time network
158s
platform
windows10_x64
resource
win10v20210408
submitted
16/08/2021, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
405ddfb635c6b65486f8b2498c2c761a.exe
Size 180KB
Sample210816-fle77rjc8e
SHA256 ce2fe316faac707fdef9aed79c1eb348f74a538fb5617ceea0a003b964c146e4
MD5 405ddfb635c6b65486f8b2498c2c761a
SHA1 d1112cf98d262cf2bec94691dbc89e0713ab5413
SHA512 1845aa8891a321d6ff0bfa8442386083955c17bb9499dc1949671f1a6a8cd1e3ca7f8b965e695cbef132b9e7c3e76852c18c7e0674e6b301d67f55eb1a73dd26
MD5 SHA1 SHA512

Score

10^/10

raccoon redline smokeloader cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor discovery evasion infostealer spyware stealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/

rc4.i32

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes

url4cnc
https://telete.in/jagressor_kz

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2040-142-0x0000000002FA0000-0x0000000003031000-memory.dmp	family_raccoon
behavioral2/memory/2040-145-0x0000000000400000-0x0000000002D05000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000200000001ab44-124.dat	family_redline
behavioral2/files/0x000200000001ab44-125.dat	family_redline
behavioral2/files/0x000200000001ab45-136.dat	family_redline
behavioral2/files/0x000200000001ab45-137.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3752 created 2040	3752	WerFault.exe	84

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
208	79A5.exe
2532	830D.exe
3468	8EE5.exe
2040	94C2.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8EE5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	830D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	830D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8EE5.exe

Deletes itself 1 IoCs

pid	Process
1964	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
2040	94C2.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000200000001ab44-124.dat	themida
behavioral2/files/0x000200000001ab44-125.dat	themida
behavioral2/memory/2532-126-0x0000000000FF0000-0x0000000000FF1000-memory.dmp	themida
behavioral2/files/0x000200000001ab45-136.dat	themida
behavioral2/files/0x000200000001ab45-137.dat	themida
behavioral2/memory/3468-155-0x0000000001320000-0x0000000001321000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	830D.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8EE5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2532	830D.exe
3468	8EE5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 528 set thread context of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74

Program crash 32 IoCs

pid	pid_target	Process	procid_target
528	2040	WerFault.exe	84
4044	2040	WerFault.exe	84
868	2040	WerFault.exe	84
3524	2040	WerFault.exe	84
3752	2040	WerFault.exe	84
1332	2040	WerFault.exe	84
2780	2040	WerFault.exe	84
3192	2040	WerFault.exe	84
2332	2040	WerFault.exe	84
660	2040	WerFault.exe	84
3096	2040	WerFault.exe	84
1404	2040	WerFault.exe	84
184	2040	WerFault.exe	84
1828	2040	WerFault.exe	84
2664	2040	WerFault.exe	84
3164	2040	WerFault.exe	84
2024	2040	WerFault.exe	84
208	2040	WerFault.exe	84
2144	2040	WerFault.exe	84
3308	2040	WerFault.exe	84
2212	2040	WerFault.exe	84
3332	2040	WerFault.exe	84
2340	2040	WerFault.exe	84
4004	2040	WerFault.exe	84
1604	2040	WerFault.exe	84
4092	2040	WerFault.exe	84
928	2040	WerFault.exe	84
188	2040	WerFault.exe	84
432	2040	WerFault.exe	84
3696	2040	WerFault.exe	84
3372	2040	WerFault.exe	84
3752	2040	WerFault.exe	84

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	405ddfb635c6b65486f8b2498c2c761a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	405ddfb635c6b65486f8b2498c2c761a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	405ddfb635c6b65486f8b2498c2c761a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
404	405ddfb635c6b65486f8b2498c2c761a.exe
404	405ddfb635c6b65486f8b2498c2c761a.exe
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
404	405ddfb635c6b65486f8b2498c2c761a.exe
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found
1964	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	2532	830D.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeRestorePrivilege	528	WerFault.exe
Token: SeBackupPrivilege	528	WerFault.exe
Token: SeDebugPrivilege	528	WerFault.exe
Token: SeDebugPrivilege	4044	WerFault.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	868	WerFault.exe
Token: SeDebugPrivilege	3524	WerFault.exe
Token: SeDebugPrivilege	3468	8EE5.exe
Token: SeDebugPrivilege	3752	WerFault.exe
Token: SeDebugPrivilege	1332	WerFault.exe
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeShutdownPrivilege	1964	Process not Found
Token: SeCreatePagefilePrivilege	1964	Process not Found
Token: SeDebugPrivilege	2780	WerFault.exe
Token: SeDebugPrivilege	3192	WerFault.exe
Token: SeDebugPrivilege	2332	WerFault.exe
Token: SeDebugPrivilege	660	WerFault.exe
Token: SeDebugPrivilege	3096	WerFault.exe
Token: SeDebugPrivilege	1404	WerFault.exe
Token: SeDebugPrivilege	184	WerFault.exe
Token: SeDebugPrivilege	1828	WerFault.exe
Token: SeDebugPrivilege	2664	WerFault.exe
Token: SeDebugPrivilege	3164	WerFault.exe
Token: SeDebugPrivilege	2024	WerFault.exe
Token: SeDebugPrivilege	208	WerFault.exe
Token: SeDebugPrivilege	2144	WerFault.exe
Token: SeDebugPrivilege	3308	WerFault.exe
Token: SeDebugPrivilege	2212	WerFault.exe
Token: SeDebugPrivilege	3332	WerFault.exe
Token: SeDebugPrivilege	2340	WerFault.exe
Token: SeDebugPrivilege	4004	WerFault.exe
Token: SeDebugPrivilege	1604	WerFault.exe
Token: SeDebugPrivilege	4092	WerFault.exe
Token: SeDebugPrivilege	928	WerFault.exe
Token: SeDebugPrivilege	188	WerFault.exe
Token: SeDebugPrivilege	432	WerFault.exe
Token: SeDebugPrivilege	3696	WerFault.exe
Token: SeDebugPrivilege	3372	WerFault.exe
Token: SeDebugPrivilege	3752	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
208	79A5.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1964	Process not Found

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74
PID 528 wrote to memory of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74
PID 528 wrote to memory of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74
PID 528 wrote to memory of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74
PID 528 wrote to memory of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74
PID 528 wrote to memory of 404	528	405ddfb635c6b65486f8b2498c2c761a.exe	74
PID 1964 wrote to memory of 208	1964	Process not Found	79
PID 1964 wrote to memory of 208	1964	Process not Found	79
PID 1964 wrote to memory of 208	1964	Process not Found	79
PID 1964 wrote to memory of 2532	1964	Process not Found	80
PID 1964 wrote to memory of 2532	1964	Process not Found	80
PID 1964 wrote to memory of 2532	1964	Process not Found	80
PID 1964 wrote to memory of 3468	1964	Process not Found	82
PID 1964 wrote to memory of 3468	1964	Process not Found	82
PID 1964 wrote to memory of 3468	1964	Process not Found	82
PID 1964 wrote to memory of 2040	1964	Process not Found	84
PID 1964 wrote to memory of 2040	1964	Process not Found	84
PID 1964 wrote to memory of 2040	1964	Process not Found	84
PID 1964 wrote to memory of 2332	1964	Process not Found	85
PID 1964 wrote to memory of 2332	1964	Process not Found	85
PID 1964 wrote to memory of 2332	1964	Process not Found	85
PID 1964 wrote to memory of 2332	1964	Process not Found	85
PID 1964 wrote to memory of 3900	1964	Process not Found	87
PID 1964 wrote to memory of 3900	1964	Process not Found	87
PID 1964 wrote to memory of 3900	1964	Process not Found	87
PID 1964 wrote to memory of 3260	1964	Process not Found	89
PID 1964 wrote to memory of 3260	1964	Process not Found	89
PID 1964 wrote to memory of 3260	1964	Process not Found	89
PID 1964 wrote to memory of 3260	1964	Process not Found	89
PID 1964 wrote to memory of 4072	1964	Process not Found	91
PID 1964 wrote to memory of 4072	1964	Process not Found	91
PID 1964 wrote to memory of 4072	1964	Process not Found	91
PID 1964 wrote to memory of 216	1964	Process not Found	95
PID 1964 wrote to memory of 216	1964	Process not Found	95
PID 1964 wrote to memory of 216	1964	Process not Found	95
PID 1964 wrote to memory of 216	1964	Process not Found	95
PID 1964 wrote to memory of 1248	1964	Process not Found	97
PID 1964 wrote to memory of 1248	1964	Process not Found	97
PID 1964 wrote to memory of 1248	1964	Process not Found	97
PID 1964 wrote to memory of 1020	1964	Process not Found	98
PID 1964 wrote to memory of 1020	1964	Process not Found	98
PID 1964 wrote to memory of 1020	1964	Process not Found	98
PID 1964 wrote to memory of 1020	1964	Process not Found	98
PID 1964 wrote to memory of 2448	1964	Process not Found	99
PID 1964 wrote to memory of 2448	1964	Process not Found	99
PID 1964 wrote to memory of 2448	1964	Process not Found	99
PID 1964 wrote to memory of 1292	1964	Process not Found	100
PID 1964 wrote to memory of 1292	1964	Process not Found	100
PID 1964 wrote to memory of 1292	1964	Process not Found	100
PID 1964 wrote to memory of 1292	1964	Process not Found	100

C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe
"C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe
  "C:\Users\Admin\AppData\Local\Temp\405ddfb635c6b65486f8b2498c2c761a.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:404

C:\Users\Admin\AppData\Local\Temp\79A5.exe
C:\Users\Admin\AppData\Local\Temp\79A5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:208

C:\Users\Admin\AppData\Local\Temp\830D.exe
C:\Users\Admin\AppData\Local\Temp\830D.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Users\Admin\AppData\Local\Temp\8EE5.exe
C:\Users\Admin\AppData\Local\Temp\8EE5.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Users\Admin\AppData\Local\Temp\94C2.exe
C:\Users\Admin\AppData\Local\Temp\94C2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 736
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 744
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 844
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 872
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1188
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1196
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1356
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1408
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1308
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1324
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1432
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1216
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1428
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1300
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1428
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1236
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3164
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1368
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1336
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1280
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1440
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1216
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1284
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1328
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1284
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1208
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1308
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1260
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1140
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1240
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1348
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1320
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1280
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2332

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3900

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3260

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:216

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1248

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1020

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2448

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-170-0x00000000028A0000-0x00000000028A9000-memory.dmp

Download

memory/216-169-0x00000000028B0000-0x00000000028B5000-memory.dmp

Download

memory/404-114-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/528-116-0x0000000002CC0000-0x0000000002D6E000-memory.dmp

Download

memory/1020-176-0x0000000003200000-0x0000000003209000-memory.dmp

Download

memory/1020-175-0x0000000003210000-0x0000000003214000-memory.dmp

Download

memory/1248-172-0x00000000001E0000-0x00000000001E6000-memory.dmp

Download

memory/1248-173-0x00000000001D0000-0x00000000001DC000-memory.dmp

Download

memory/1292-182-0x0000000003010000-0x0000000003019000-memory.dmp

Download

memory/1292-181-0x0000000003020000-0x0000000003025000-memory.dmp

Download

memory/1964-117-0x0000000001300000-0x0000000001316000-memory.dmp

Download

memory/2040-142-0x0000000002FA0000-0x0000000003031000-memory.dmp

Download

memory/2040-145-0x0000000000400000-0x0000000002D05000-memory.dmp

Download

memory/2332-143-0x0000000002EE0000-0x0000000002F54000-memory.dmp

Download

memory/2332-144-0x0000000002E70000-0x0000000002EDB000-memory.dmp

Download

memory/2448-179-0x0000000000CE0000-0x0000000000CE9000-memory.dmp

Download

memory/2448-178-0x0000000000CF0000-0x0000000000CF5000-memory.dmp

Download

memory/2532-133-0x0000000005E20000-0x0000000005E21000-memory.dmp

Download

memory/2532-185-0x0000000007680000-0x0000000007681000-memory.dmp

Download

memory/2532-129-0x0000000006320000-0x0000000006321000-memory.dmp

Download

memory/2532-159-0x0000000008170000-0x0000000008171000-memory.dmp

Download

memory/2532-161-0x0000000007310000-0x0000000007311000-memory.dmp

Download

memory/2532-130-0x0000000003A90000-0x0000000003A91000-memory.dmp

Download

memory/2532-126-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/2532-184-0x0000000007C70000-0x0000000007C71000-memory.dmp

Download

memory/2532-131-0x0000000005C20000-0x0000000005C21000-memory.dmp

Download

memory/2532-152-0x0000000007040000-0x0000000007041000-memory.dmp

Download

memory/2532-128-0x0000000076F40000-0x00000000770CE000-memory.dmp

Download

memory/2532-132-0x0000000005C60000-0x0000000005C61000-memory.dmp

Download

memory/2532-134-0x0000000005D00000-0x0000000005D01000-memory.dmp

Download

memory/2532-183-0x0000000007580000-0x0000000007581000-memory.dmp

Download

memory/2532-154-0x0000000007740000-0x0000000007741000-memory.dmp

Download

memory/3260-151-0x0000000002A90000-0x0000000002A9B000-memory.dmp

Download

memory/3260-150-0x0000000002AA0000-0x0000000002AA7000-memory.dmp

Download

memory/3468-166-0x0000000005D60000-0x0000000005D61000-memory.dmp

Download

memory/3468-163-0x0000000076F40000-0x00000000770CE000-memory.dmp

Download

memory/3468-155-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/3900-147-0x0000000000980000-0x0000000000987000-memory.dmp

Download

memory/3900-148-0x0000000000970000-0x000000000097C000-memory.dmp

Download

memory/4072-165-0x0000000000590000-0x000000000059F000-memory.dmp

Download

memory/4072-164-0x00000000005A0000-0x00000000005A9000-memory.dmp

Download