raccoon | e9abbf811d367cf26f493d72ccd96749e534804ac27d36956dce0484b1440f25

Analysis

max time kernel
153s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
19/08/2021, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
Size 276KB
Sample210819-yyctqb3bfx
SHA256 e9abbf811d367cf26f493d72ccd96749e534804ac27d36956dce0484b1440f25
MD5 a88e2f5154670eb958322b44f2493fc7
SHA1 56dbf9ca3ca68877d8df6b578d96dd8867642667
SHA512 70653cecf0d6532a85b35e0500e58a9b725758d3873b252f40c327eaa0a7326fadc0c166c64352396dc31312a379924a11e4d7a5fe0704088c01d38b499130c8
MD5 SHA1 SHA512

Score

10^/10

raccoon redline smokeloader #mix 19.08 b1a595eac9265caef93f4d54354e4e71594872f2 fe582536ec580228180f270f7cb80a867860e010 agilenet backdoor discovery evasion infostealer spyware stealer suricata themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
http://185.215.113.57/forum/

rc4.i32

Extracted

Family

raccoon

Botnet

b1a595eac9265caef93f4d54354e4e71594872f2

Attributes

url4cnc
https://telete.in/hobaoparunjohnyrun2

rc4.plain

Extracted

Family

raccoon

Botnet

fe582536ec580228180f270f7cb80a867860e010

Attributes

url4cnc
https://telete.in/xylichanjk

rc4.plain

Extracted

Family

redline

Botnet

#MIX 19.08

gophamanapr.site:80

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 13 IoCs

resource	yara_rule
behavioral2/files/0x000200000001ab45-124.dat	family_redline
behavioral2/files/0x000200000001ab45-125.dat	family_redline
behavioral2/files/0x000200000001ab48-148.dat	family_redline
behavioral2/files/0x000200000001ab48-149.dat	family_redline
behavioral2/memory/2952-241-0x0000000004C90000-0x0000000004CAC000-memory.dmp	family_redline
behavioral2/memory/2952-247-0x0000000004D00000-0x0000000004D1A000-memory.dmp	family_redline
behavioral2/memory/4300-278-0x0000000000418F7E-mapping.dmp	family_redline
behavioral2/memory/4300-293-0x0000000005840000-0x0000000005E46000-memory.dmp	family_redline
behavioral2/memory/5044-317-0x0000000000418F72-mapping.dmp	family_redline
behavioral2/memory/5028-327-0x00000000054A0000-0x000000000599E000-memory.dmp	family_redline
behavioral2/memory/5044-336-0x0000000004F20000-0x0000000005526000-memory.dmp	family_redline
behavioral2/memory/4340-349-0x0000000000418F8E-mapping.dmp	family_redline
behavioral2/memory/4340-359-0x0000000004DA0000-0x00000000053A6000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4888 created 2376	4888	WerFault.exe	91

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Downloads MZ/PE file

Executes dropped EXE 18 IoCs

pid	Process
2952	EF47.exe
1280	F294.exe
732	F65E.exe
2168	FC5A.exe
3984	90D.exe
3736	D25.exe
4044	F65E.exe
2412	16AC.exe
2376	196C.exe
2952	1A47.exe
4180	jfN8IphZjN.exe
4300	jfN8IphZjN.exe
4876	123.exe
5028	WindowsHelper.exe
5044	16AC.exe
4296	WindowsHelper.exe
4192	WindowsHelper.exe
4340	WindowsHelper.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	F294.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	F294.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FC5A.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FC5A.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	90D.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	90D.exe

Deletes itself 1 IoCs

pid	Process
3020	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
4044	F65E.exe
4044	F65E.exe
4044	F65E.exe
4044	F65E.exe
4044	F65E.exe
2376	196C.exe
2376	196C.exe
2376	196C.exe

Obfuscated with Agile.Net obfuscator 3 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/files/0x000200000001ab4b-178.dat	agile_net
behavioral2/files/0x000200000001ab4b-177.dat	agile_net
behavioral2/files/0x000200000001ab4b-318.dat	agile_net

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000200000001ab45-124.dat	themida
behavioral2/files/0x000200000001ab45-125.dat	themida
behavioral2/memory/1280-130-0x00000000013D0000-0x00000000013D1000-memory.dmp	themida
behavioral2/files/0x000200000001ab47-137.dat	themida
behavioral2/files/0x000200000001ab47-139.dat	themida
behavioral2/files/0x000200000001ab48-148.dat	themida
behavioral2/files/0x000200000001ab48-149.dat	themida
behavioral2/memory/3984-155-0x0000000000260000-0x0000000000261000-memory.dmp	themida
behavioral2/memory/2168-154-0x00000000003F0000-0x00000000003F1000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	F294.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FC5A.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	90D.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
1280	F294.exe
2168	FC5A.exe
3984	90D.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 364 set thread context of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 732 set thread context of 4044	732	F65E.exe	86
PID 4180 set thread context of 4300	4180	jfN8IphZjN.exe	108
PID 2412 set thread context of 5044	2412	16AC.exe	120
PID 5028 set thread context of 4340	5028	WindowsHelper.exe	124

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
4636	2376	WerFault.exe	91
4688	2376	WerFault.exe	91
4716	2376	WerFault.exe	91
4756	2376	WerFault.exe	91
4792	2376	WerFault.exe	91
4836	2376	WerFault.exe	91
4888	2376	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	123.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	123.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4312	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1836	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
1836	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	Process not Found

Suspicious behavior: MapViewOfSection 20 IoCs

pid	Process
1836	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
3020	Process not Found
4876	123.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	1280	F294.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	3984	90D.exe
Token: SeDebugPrivilege	2168	FC5A.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	2952	1A47.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeDebugPrivilege	4300	jfN8IphZjN.exe
Token: SeShutdownPrivilege	3020	Process not Found
Token: SeCreatePagefilePrivilege	3020	Process not Found
Token: SeShutdownPrivilege	3020	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2952	EF47.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3020	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 364 wrote to memory of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 364 wrote to memory of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 364 wrote to memory of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 364 wrote to memory of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 364 wrote to memory of 1836	364	e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe	75
PID 3020 wrote to memory of 2952	3020	Process not Found	79
PID 3020 wrote to memory of 2952	3020	Process not Found	79
PID 3020 wrote to memory of 2952	3020	Process not Found	79
PID 3020 wrote to memory of 1280	3020	Process not Found	80
PID 3020 wrote to memory of 1280	3020	Process not Found	80
PID 3020 wrote to memory of 1280	3020	Process not Found	80
PID 3020 wrote to memory of 732	3020	Process not Found	82
PID 3020 wrote to memory of 732	3020	Process not Found	82
PID 3020 wrote to memory of 732	3020	Process not Found	82
PID 3020 wrote to memory of 2168	3020	Process not Found	84
PID 3020 wrote to memory of 2168	3020	Process not Found	84
PID 3020 wrote to memory of 2168	3020	Process not Found	84
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 3020 wrote to memory of 3984	3020	Process not Found	87
PID 3020 wrote to memory of 3984	3020	Process not Found	87
PID 3020 wrote to memory of 3984	3020	Process not Found	87
PID 3020 wrote to memory of 3736	3020	Process not Found	89
PID 3020 wrote to memory of 3736	3020	Process not Found	89
PID 3020 wrote to memory of 3736	3020	Process not Found	89
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 732 wrote to memory of 4044	732	F65E.exe	86
PID 3020 wrote to memory of 2412	3020	Process not Found	90
PID 3020 wrote to memory of 2412	3020	Process not Found	90
PID 3020 wrote to memory of 2412	3020	Process not Found	90
PID 3020 wrote to memory of 2376	3020	Process not Found	91
PID 3020 wrote to memory of 2376	3020	Process not Found	91
PID 3020 wrote to memory of 2376	3020	Process not Found	91
PID 3020 wrote to memory of 2952	3020	Process not Found	92
PID 3020 wrote to memory of 2952	3020	Process not Found	92
PID 3020 wrote to memory of 2952	3020	Process not Found	92
PID 3020 wrote to memory of 2344	3020	Process not Found	94
PID 3020 wrote to memory of 2344	3020	Process not Found	94
PID 3020 wrote to memory of 2344	3020	Process not Found	94
PID 3020 wrote to memory of 2344	3020	Process not Found	94
PID 3020 wrote to memory of 3712	3020	Process not Found	95
PID 3020 wrote to memory of 3712	3020	Process not Found	95
PID 3020 wrote to memory of 3712	3020	Process not Found	95
PID 3020 wrote to memory of 3136	3020	Process not Found	96
PID 3020 wrote to memory of 3136	3020	Process not Found	96
PID 3020 wrote to memory of 3136	3020	Process not Found	96
PID 3020 wrote to memory of 3136	3020	Process not Found	96
PID 3020 wrote to memory of 1276	3020	Process not Found	97
PID 3020 wrote to memory of 1276	3020	Process not Found	97
PID 3020 wrote to memory of 1276	3020	Process not Found	97
PID 3020 wrote to memory of 2208	3020	Process not Found	98
PID 3020 wrote to memory of 2208	3020	Process not Found	98
PID 3020 wrote to memory of 2208	3020	Process not Found	98
PID 3020 wrote to memory of 2208	3020	Process not Found	98
PID 3020 wrote to memory of 496	3020	Process not Found	99
PID 3020 wrote to memory of 496	3020	Process not Found	99
PID 3020 wrote to memory of 496	3020	Process not Found	99
PID 3020 wrote to memory of 3548	3020	Process not Found	100

C:\Users\Admin\AppData\Local\Temp\e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
"C:\Users\Admin\AppData\Local\Temp\e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364
- C:\Users\Admin\AppData\Local\Temp\e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe
  "C:\Users\Admin\AppData\Local\Temp\e9abbf811d367cf26f493d72ccd96749e534804ac27d3.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1836

C:\Users\Admin\AppData\Local\Temp\EF47.exe
C:\Users\Admin\AppData\Local\Temp\EF47.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2952

C:\Users\Admin\AppData\Local\Temp\F294.exe
C:\Users\Admin\AppData\Local\Temp\F294.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Users\Admin\AppData\Local\Temp\F65E.exe
C:\Users\Admin\AppData\Local\Temp\F65E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:732
- C:\Users\Admin\AppData\Local\Temp\F65E.exe
  C:\Users\Admin\AppData\Local\Temp\F65E.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4044
- - C:\Users\Admin\AppData\Local\Temp\jfN8IphZjN.exe
    "C:\Users\Admin\AppData\Local\Temp\jfN8IphZjN.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\jfN8IphZjN.exe
      C:\Users\Admin\AppData\Local\Temp\jfN8IphZjN.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\123.exe"
        5⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious behavior: MapViewOfSection
        
        PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F65E.exe"
    3⤵
    PID:4216
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:4312

C:\Users\Admin\AppData\Local\Temp\FC5A.exe
C:\Users\Admin\AppData\Local\Temp\FC5A.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Users\Admin\AppData\Local\Temp\90D.exe
C:\Users\Admin\AppData\Local\Temp\90D.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3984

C:\Users\Admin\AppData\Local\Temp\D25.exe
C:\Users\Admin\AppData\Local\Temp\D25.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Users\Admin\AppData\Local\Temp\16AC.exe
C:\Users\Admin\AppData\Local\Temp\16AC.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2412
- C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe"
    3⤵
    - Executes dropped EXE
    PID:4296
- - C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe"
    3⤵
    - Executes dropped EXE
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsHelper.exe"
    3⤵
    - Executes dropped EXE
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\16AC.exe
  "C:\Users\Admin\AppData\Local\Temp\16AC.exe"
  2⤵
  - Executes dropped EXE
  PID:5044

C:\Users\Admin\AppData\Local\Temp\196C.exe
C:\Users\Admin\AppData\Local\Temp\196C.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 792
  2⤵
  - Program crash
  PID:4636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 884
  2⤵
  - Program crash
  PID:4688
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 924
  2⤵
  - Program crash
  PID:4716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 876
  2⤵
  - Program crash
  PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1128
  2⤵
  - Program crash
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1148
  2⤵
  - Program crash
  PID:4836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 848
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  PID:4888

C:\Users\Admin\AppData\Local\Temp\1A47.exe
C:\Users\Admin\AppData\Local\Temp\1A47.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2344

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3712

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3136

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1276

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2208

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:496

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3548

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2180

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-114-0x0000000000030000-0x000000000003A000-memory.dmp

Download

memory/496-228-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/496-226-0x00000000001F0000-0x00000000001F6000-memory.dmp

Download

memory/732-141-0x0000000004B00000-0x0000000004B01000-memory.dmp

Download

memory/732-145-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/732-142-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/732-135-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/732-129-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/1276-208-0x0000000000F00000-0x0000000000F09000-memory.dmp

Download

memory/1276-209-0x0000000000EF0000-0x0000000000EFF000-memory.dmp

Download

memory/1280-218-0x0000000007790000-0x0000000007791000-memory.dmp

Download

memory/1280-130-0x00000000013D0000-0x00000000013D1000-memory.dmp

Download

memory/1280-143-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Download

memory/1280-144-0x0000000005B10000-0x0000000005B11000-memory.dmp

Download

memory/1280-133-0x0000000077860000-0x00000000779EE000-memory.dmp

Download

memory/1280-217-0x0000000007090000-0x0000000007091000-memory.dmp

Download

memory/1280-134-0x0000000006130000-0x0000000006131000-memory.dmp

Download

memory/1280-140-0x0000000005B80000-0x0000000005B81000-memory.dmp

Download

memory/1280-146-0x0000000005D60000-0x0000000005D61000-memory.dmp

Download

memory/1280-138-0x0000000005B20000-0x0000000005B21000-memory.dmp

Download

memory/1836-115-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2168-154-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/2168-157-0x0000000077860000-0x00000000779EE000-memory.dmp

Download

memory/2168-175-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/2180-236-0x0000000000E30000-0x0000000000E39000-memory.dmp

Download

memory/2180-235-0x0000000000E40000-0x0000000000E45000-memory.dmp

Download

memory/2208-213-0x00000000030F0000-0x00000000030F5000-memory.dmp

Download

memory/2208-214-0x00000000030E0000-0x00000000030E9000-memory.dmp

Download

memory/2344-197-0x0000000000900000-0x0000000000974000-memory.dmp

Download

memory/2344-200-0x0000000000890000-0x00000000008FB000-memory.dmp

Download

memory/2376-243-0x0000000000400000-0x0000000002CB9000-memory.dmp

Download

memory/2376-242-0x00000000001E0000-0x00000000001F9000-memory.dmp

Download

memory/2412-194-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/2412-183-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/2412-192-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download

memory/2412-181-0x00000000051B0000-0x00000000051B1000-memory.dmp

Download

memory/2412-179-0x00000000006F0000-0x00000000006F1000-memory.dmp

Download

memory/2412-191-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/2412-201-0x00000000053E0000-0x00000000053F1000-memory.dmp

Download

memory/2412-198-0x00000000074E0000-0x000000000757F000-memory.dmp

Download

memory/2524-251-0x00000000008A0000-0x00000000008A9000-memory.dmp

Download

memory/2524-249-0x00000000008B0000-0x00000000008B5000-memory.dmp

Download

memory/2952-247-0x0000000004D00000-0x0000000004D1A000-memory.dmp

Download

memory/2952-258-0x00000000073D4000-0x00000000073D6000-memory.dmp

Download

memory/2952-241-0x0000000004C90000-0x0000000004CAC000-memory.dmp

Download

memory/2952-244-0x00000000073D2000-0x00000000073D3000-memory.dmp

Download

memory/2952-246-0x00000000073D3000-0x00000000073D4000-memory.dmp

Download

memory/2952-248-0x0000000002E20000-0x0000000002F6A000-memory.dmp

Download

memory/2952-254-0x00000000073D0000-0x00000000073D1000-memory.dmp

Download

memory/2952-253-0x0000000000400000-0x0000000002CCD000-memory.dmp

Download

memory/3020-117-0x00000000010D0000-0x00000000010E6000-memory.dmp

Download

memory/3020-310-0x0000000001100000-0x0000000001115000-memory.dmp

Download

memory/3136-206-0x0000000000510000-0x0000000000517000-memory.dmp

Download

memory/3136-207-0x0000000000500000-0x000000000050B000-memory.dmp

Download

memory/3548-233-0x00000000008D0000-0x00000000008D9000-memory.dmp

Download

memory/3548-232-0x00000000008E0000-0x00000000008E4000-memory.dmp

Download

memory/3712-202-0x0000000000710000-0x0000000000717000-memory.dmp

Download

memory/3712-204-0x0000000000700000-0x000000000070C000-memory.dmp

Download

memory/3736-189-0x0000000002660000-0x00000000026EF000-memory.dmp

Download

memory/3736-190-0x0000000000400000-0x00000000023EE000-memory.dmp

Download

memory/3984-155-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/3984-159-0x0000000077860000-0x00000000779EE000-memory.dmp

Download

memory/3984-171-0x00000000057D0000-0x00000000057D1000-memory.dmp

Download

memory/3984-227-0x0000000006E60000-0x0000000006E61000-memory.dmp

Download

memory/4044-162-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4044-173-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4180-269-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/4180-264-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/4300-293-0x0000000005840000-0x0000000005E46000-memory.dmp

Download

memory/4340-359-0x0000000004DA0000-0x00000000053A6000-memory.dmp

Download

memory/4876-309-0x0000000000400000-0x0000000002CB7000-memory.dmp

Download

memory/4876-308-0x0000000002CD0000-0x0000000002CD9000-memory.dmp

Download

memory/5028-327-0x00000000054A0000-0x000000000599E000-memory.dmp

Download

memory/5044-336-0x0000000004F20000-0x0000000005526000-memory.dmp

Download