redline | 6e67e541d5801d97cb6fc3ec483b7b9dc302506c0f3a1ef0942ea3f7126e9e87

Analysis

max time kernel
151s
max time network
151s
platform
windows10_x64
resource
win10v20210410
submitted
24/08/2021, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
213B4D4A3FA8742FD83229A8BE042BB9.exe
Size 4.3MB
Sample210824-nwns8shr22
SHA256 6e67e541d5801d97cb6fc3ec483b7b9dc302506c0f3a1ef0942ea3f7126e9e87
MD5 213b4d4a3fa8742fd83229a8be042bb9
SHA1 22a20207263c5f6aea6e2174fb4544714ddf4a32
SHA512 ce420a54d1f319502aac71ffa6da7457eca4bf0be30b4c4d27ce0040205ecc62136f559d567362d277b1d3752d6bbc8756c9f919c2bd7b91ec78463920fee34d
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader socelars vidar 706 pub1 aspackv2 backdoor infostealer persistence stealer suricata themida trojan

Malware Config

Extracted

Family

redline

Botnet

pub1

viacetequn.site:80

Extracted

Family

vidar

Version

40.1

Botnet

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4116-207-0x0000000004BE0000-0x0000000004BFC000-memory.dmp	family_redline
behavioral2/memory/4116-211-0x0000000004C70000-0x0000000004C8A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00020000000155f2-242.dat	family_socelars
behavioral2/files/0x00020000000155f2-243.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/352-204-0x0000000004920000-0x00000000049BD000-memory.dmp	family_vidar
behavioral2/memory/352-225-0x0000000000400000-0x0000000002D0E000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000100000001ab60-122.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab60-124.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab62-126.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5f-129.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5f-127.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab5f-123.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab62-130.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
2096	setup_installer.exe
2456	setup_install.exe
3172	Fri1925d9ac2c1.exe
2124	Fri19673ed1dece.exe
352	Fri19c8b39c17cf87d0d.exe
2636	Fri193178698e28d.exe
4116	Fri19bba638b6340.exe
4208	Fri19684b7c65.exe
4220	Fri199a782d2f821b345.exe
4300	Fri196814a5b87cc7.exe
4308	Fri19089f5589cd7fd.exe

Loads dropped DLL 6 IoCs

pid	Process
2456	setup_install.exe
2456	setup_install.exe
2456	setup_install.exe
2456	setup_install.exe
2456	setup_install.exe
2456	setup_install.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000100000001ab96-345.dat	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Fri19089f5589cd7fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Fri19089f5589cd7fd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com
36	ipinfo.io
37	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4336	352	WerFault.exe	87
4424	352	WerFault.exe	87
4808	4248	WerFault.exe	107
4884	352	WerFault.exe	87
4016	352	WerFault.exe	87
5052	352	WerFault.exe	87
4468	352	WerFault.exe	87
5072	352	WerFault.exe	87
5420	4408	WerFault.exe	110
6028	352	WerFault.exe	87

Kills process with taskkill 1 IoCs

evasion

pid	Process
5128	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2144	powershell.exe
2144	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	Fri196814a5b87cc7.exe
Token: SeDebugPrivilege	4208	Fri19684b7c65.exe
Token: SeDebugPrivilege	2144	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 2096	4036	213B4D4A3FA8742FD83229A8BE042BB9.exe	75
PID 4036 wrote to memory of 2096	4036	213B4D4A3FA8742FD83229A8BE042BB9.exe	75
PID 4036 wrote to memory of 2096	4036	213B4D4A3FA8742FD83229A8BE042BB9.exe	75
PID 2096 wrote to memory of 2456	2096	setup_installer.exe	76
PID 2096 wrote to memory of 2456	2096	setup_installer.exe	76
PID 2096 wrote to memory of 2456	2096	setup_installer.exe	76
PID 2456 wrote to memory of 3904	2456	setup_install.exe	79
PID 2456 wrote to memory of 3904	2456	setup_install.exe	79
PID 2456 wrote to memory of 3904	2456	setup_install.exe	79
PID 2456 wrote to memory of 3208	2456	setup_install.exe	80
PID 2456 wrote to memory of 3208	2456	setup_install.exe	80
PID 2456 wrote to memory of 3208	2456	setup_install.exe	80
PID 2456 wrote to memory of 2852	2456	setup_install.exe	81
PID 2456 wrote to memory of 2852	2456	setup_install.exe	81
PID 2456 wrote to memory of 2852	2456	setup_install.exe	81
PID 2456 wrote to memory of 756	2456	setup_install.exe	82
PID 2456 wrote to memory of 756	2456	setup_install.exe	82
PID 2456 wrote to memory of 756	2456	setup_install.exe	82
PID 2456 wrote to memory of 3960	2456	setup_install.exe	83
PID 2456 wrote to memory of 3960	2456	setup_install.exe	83
PID 2456 wrote to memory of 3960	2456	setup_install.exe	83
PID 2456 wrote to memory of 648	2456	setup_install.exe	96
PID 2456 wrote to memory of 648	2456	setup_install.exe	96
PID 2456 wrote to memory of 648	2456	setup_install.exe	96
PID 2456 wrote to memory of 2020	2456	setup_install.exe	95
PID 2456 wrote to memory of 2020	2456	setup_install.exe	95
PID 2456 wrote to memory of 2020	2456	setup_install.exe	95
PID 2456 wrote to memory of 392	2456	setup_install.exe	94
PID 2456 wrote to memory of 392	2456	setup_install.exe	94
PID 2456 wrote to memory of 392	2456	setup_install.exe	94
PID 2456 wrote to memory of 2316	2456	setup_install.exe	84
PID 2456 wrote to memory of 2316	2456	setup_install.exe	84
PID 2456 wrote to memory of 2316	2456	setup_install.exe	84
PID 2456 wrote to memory of 3864	2456	setup_install.exe	85
PID 2456 wrote to memory of 3864	2456	setup_install.exe	85
PID 2456 wrote to memory of 3864	2456	setup_install.exe	85
PID 3904 wrote to memory of 2144	3904	cmd.exe	93
PID 3904 wrote to memory of 2144	3904	cmd.exe	93
PID 3904 wrote to memory of 2144	3904	cmd.exe	93
PID 3208 wrote to memory of 3172	3208	cmd.exe	92
PID 3208 wrote to memory of 3172	3208	cmd.exe	92
PID 3208 wrote to memory of 3172	3208	cmd.exe	92
PID 2852 wrote to memory of 2124	2852	cmd.exe	86
PID 2852 wrote to memory of 2124	2852	cmd.exe	86
PID 2852 wrote to memory of 2124	2852	cmd.exe	86
PID 3960 wrote to memory of 352	3960	cmd.exe	87
PID 3960 wrote to memory of 352	3960	cmd.exe	87
PID 3960 wrote to memory of 352	3960	cmd.exe	87
PID 756 wrote to memory of 2636	756	cmd.exe	88
PID 756 wrote to memory of 2636	756	cmd.exe	88
PID 648 wrote to memory of 4116	648	cmd.exe	89
PID 648 wrote to memory of 4116	648	cmd.exe	89
PID 648 wrote to memory of 4116	648	cmd.exe	89
PID 392 wrote to memory of 4208	392	cmd.exe	91
PID 392 wrote to memory of 4208	392	cmd.exe	91
PID 2020 wrote to memory of 4220	2020	cmd.exe	90
PID 2020 wrote to memory of 4220	2020	cmd.exe	90
PID 2020 wrote to memory of 4220	2020	cmd.exe	90
PID 3864 wrote to memory of 4300	3864	cmd.exe	98
PID 3864 wrote to memory of 4300	3864	cmd.exe	98
PID 2316 wrote to memory of 4308	2316	cmd.exe	97
PID 2316 wrote to memory of 4308	2316	cmd.exe	97
PID 2316 wrote to memory of 4308	2316	cmd.exe	97
PID 4308 wrote to memory of 4468	4308	Fri19089f5589cd7fd.exe	122

C:\Users\Admin\AppData\Local\Temp\213B4D4A3FA8742FD83229A8BE042BB9.exe
"C:\Users\Admin\AppData\Local\Temp\213B4D4A3FA8742FD83229A8BE042BB9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri1925d9ac2c1.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri1925d9ac2c1.exe
        
        Fri1925d9ac2c1.exe
        5⤵
        Executes dropped EXE
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri1925d9ac2c1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri1925d9ac2c1.exe" -a
        6⤵
        
        PID:4600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri19673ed1dece.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri19673ed1dece.exe
        
        Fri19673ed1dece.exe
        5⤵
        Executes dropped EXE
        
        PID:2124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri193178698e28d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri193178698e28d.exe
        
        Fri193178698e28d.exe
        5⤵
        Executes dropped EXE
        
        PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri19c8b39c17cf87d0d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri19c8b39c17cf87d0d.exe
        
        Fri19c8b39c17cf87d0d.exe
        5⤵
        Executes dropped EXE
        
        PID:352
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 764
        6⤵
        Program crash
        
        PID:4336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 788
        6⤵
        Program crash
        
        PID:4424
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 748
        6⤵
        Program crash
        
        PID:4884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 828
        6⤵
        Program crash
        
        PID:4016
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 960
        6⤵
        Program crash
        
        PID:5052
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 1020
        6⤵
        Program crash
        
        PID:4468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 932
        6⤵
        Program crash
        
        PID:5072
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 352 -s 996
        6⤵
        Program crash
        
        PID:6028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri19089f5589cd7fd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri19089f5589cd7fd.exe
        
        Fri19089f5589cd7fd.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        6⤵
        
        PID:4468
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Abbassero.wmv
        6⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        7⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv
        8⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
        
        Piu.exe.com L
        8⤵
        
        PID:6000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri196814a5b87cc7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri196814a5b87cc7.exe
        
        Fri196814a5b87cc7.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        7⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        8⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        9⤵
        Kills process with taskkill
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3.exe"
        7⤵
        
        PID:4248
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 4248 -s 1528
        8⤵
        Program crash
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        7⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 668
        8⤵
        Program crash
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1.exe"
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Chrome3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome3.exe"
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        7⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6.exe"
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        7⤵
        
        PID:4060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri19684b7c65.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:392
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri199a782d2f821b345.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Fri19bba638b6340.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:648

C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri19bba638b6340.exe
Fri19bba638b6340.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri199a782d2f821b345.exe
Fri199a782d2f821b345.exe
1⤵
- Executes dropped EXE
PID:4220
- C:\Users\Admin\Documents\_uaA2cwaqeXMAW3O5b5cKB2p.exe
  "C:\Users\Admin\Documents\_uaA2cwaqeXMAW3O5b5cKB2p.exe"
  2⤵
  PID:4660
- C:\Users\Admin\Documents\Mhahu7LEgfRIlfgVmRCqNZsm.exe
  "C:\Users\Admin\Documents\Mhahu7LEgfRIlfgVmRCqNZsm.exe"
  2⤵
  PID:4816
- C:\Users\Admin\Documents\vrzk3CFNHnHEBpgqPa4VokJ0.exe
  "C:\Users\Admin\Documents\vrzk3CFNHnHEBpgqPa4VokJ0.exe"
  2⤵
  PID:4804
- C:\Users\Admin\Documents\mZLUagMiock1eiTL0aLvivrU.exe
  "C:\Users\Admin\Documents\mZLUagMiock1eiTL0aLvivrU.exe"
  2⤵
  PID:4112
- C:\Users\Admin\Documents\mYU1DLm053_y9fNr8LerikrT.exe
  "C:\Users\Admin\Documents\mYU1DLm053_y9fNr8LerikrT.exe"
  2⤵
  PID:4296
- C:\Users\Admin\Documents\ah7PYu98z1rSIjUJj5bohjiB.exe
  "C:\Users\Admin\Documents\ah7PYu98z1rSIjUJj5bohjiB.exe"
  2⤵
  PID:5208
- C:\Users\Admin\Documents\7fc05RpCpqnOKyrcyyFWFCrB.exe
  "C:\Users\Admin\Documents\7fc05RpCpqnOKyrcyyFWFCrB.exe"
  2⤵
  PID:5340
- C:\Users\Admin\Documents\dyjAIMLvCK5UqZ51ZBdgbKpi.exe
  "C:\Users\Admin\Documents\dyjAIMLvCK5UqZ51ZBdgbKpi.exe"
  2⤵
  PID:5304
- C:\Users\Admin\Documents\QBuu8zs7HskSKRurCIbztH99.exe
  "C:\Users\Admin\Documents\QBuu8zs7HskSKRurCIbztH99.exe"
  2⤵
  PID:5280
- C:\Users\Admin\Documents\5jG4W9_NSFkCq6FMqaWN58QH.exe
  "C:\Users\Admin\Documents\5jG4W9_NSFkCq6FMqaWN58QH.exe"
  2⤵
  PID:5272
- C:\Users\Admin\Documents\u3bGzvOX1TgXId3Nio_U6t1o.exe
  "C:\Users\Admin\Documents\u3bGzvOX1TgXId3Nio_U6t1o.exe"
  2⤵
  PID:5296
- C:\Users\Admin\Documents\lZmLBwZ8H1aE6a1nBRIPCfks.exe
  "C:\Users\Admin\Documents\lZmLBwZ8H1aE6a1nBRIPCfks.exe"
  2⤵
  PID:5288
- C:\Users\Admin\Documents\GOB4UNArXWQPnpHb8PXDbpFr.exe
  "C:\Users\Admin\Documents\GOB4UNArXWQPnpHb8PXDbpFr.exe"
  2⤵
  PID:5572
- C:\Users\Admin\Documents\CS3n41WSUqkXo2bYDsrXA66s.exe
  "C:\Users\Admin\Documents\CS3n41WSUqkXo2bYDsrXA66s.exe"
  2⤵
  PID:5556
- C:\Users\Admin\Documents\AeG5QTmHEzNWEKXhRHKtx9D0.exe
  "C:\Users\Admin\Documents\AeG5QTmHEzNWEKXhRHKtx9D0.exe"
  2⤵
  PID:5512
- C:\Users\Admin\Documents\_8utmR8iQzaLKqupao76q2Eu.exe
  "C:\Users\Admin\Documents\_8utmR8iQzaLKqupao76q2Eu.exe"
  2⤵
  PID:5500
- C:\Users\Admin\Documents\eMvPoBAblmRKDpetlbLeTSS8.exe
  "C:\Users\Admin\Documents\eMvPoBAblmRKDpetlbLeTSS8.exe"
  2⤵
  PID:5480
- C:\Users\Admin\Documents\MmecjUh0epgNoW0ui53GOMYs.exe
  "C:\Users\Admin\Documents\MmecjUh0epgNoW0ui53GOMYs.exe"
  2⤵
  PID:5456
- C:\Users\Admin\Documents\EokZyuo_VuwGbleHFiY8T7Pt.exe
  "C:\Users\Admin\Documents\EokZyuo_VuwGbleHFiY8T7Pt.exe"
  2⤵
  PID:5428
- C:\Users\Admin\Documents\5IaSPxQ6ngsc02t7VKGvOZfw.exe
  "C:\Users\Admin\Documents\5IaSPxQ6ngsc02t7VKGvOZfw.exe"
  2⤵
  PID:5408
- C:\Users\Admin\Documents\qvaSYesPygb5g5MCPEBpva00.exe
  "C:\Users\Admin\Documents\qvaSYesPygb5g5MCPEBpva00.exe"
  2⤵
  PID:5364
- C:\Users\Admin\Documents\1yLh1JFU4fVuZ6NYAc6Ou_TS.exe
  "C:\Users\Admin\Documents\1yLh1JFU4fVuZ6NYAc6Ou_TS.exe"
  2⤵
  PID:6048

C:\Users\Admin\AppData\Local\Temp\7zS0386DC24\Fri19684b7c65.exe
Fri19684b7c65.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-204-0x0000000004920000-0x00000000049BD000-memory.dmp

Download

memory/352-225-0x0000000000400000-0x0000000002D0E000-memory.dmp

Download

memory/2124-202-0x0000000002D10000-0x0000000002D19000-memory.dmp

Download

memory/2124-222-0x0000000000400000-0x0000000002CB3000-memory.dmp

Download

memory/2144-194-0x0000000007870000-0x0000000007871000-memory.dmp

Download

memory/2144-261-0x00000000091F0000-0x0000000009223000-memory.dmp

Download

memory/2144-196-0x0000000007B80000-0x0000000007B81000-memory.dmp

Download

memory/2144-186-0x0000000006AB2000-0x0000000006AB3000-memory.dmp

Download

memory/2144-286-0x0000000009520000-0x0000000009521000-memory.dmp

Download

memory/2144-199-0x0000000007A70000-0x0000000007A71000-memory.dmp

Download

memory/2144-200-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Download

memory/2144-195-0x00000000079E0000-0x00000000079E1000-memory.dmp

Download

memory/2144-201-0x0000000008360000-0x0000000008361000-memory.dmp

Download

memory/2144-178-0x0000000007130000-0x0000000007131000-memory.dmp

Download

memory/2144-173-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Download

memory/2144-285-0x0000000009320000-0x0000000009321000-memory.dmp

Download

memory/2144-191-0x00000000077D0000-0x00000000077D1000-memory.dmp

Download

memory/2144-292-0x0000000006AB3000-0x0000000006AB4000-memory.dmp

Download

memory/2144-174-0x0000000006AC0000-0x0000000006AC1000-memory.dmp

Download

memory/2144-274-0x0000000007F90000-0x0000000007F91000-memory.dmp

Download

memory/2144-260-0x000000007EC80000-0x000000007EC81000-memory.dmp

Download

memory/2456-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2456-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2456-164-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2456-167-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2456-170-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2456-133-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/2456-175-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2636-206-0x000001F164410000-0x000001F164571000-memory.dmp

Download

memory/2636-205-0x000001F1641C0000-0x000001F1642A4000-memory.dmp

Download

memory/3120-303-0x0000000002EC0000-0x0000000002ED6000-memory.dmp

Download

memory/4060-281-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/4060-290-0x0000000003130000-0x0000000003131000-memory.dmp

Download

memory/4112-358-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/4112-374-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

memory/4112-354-0x0000000000300000-0x0000000000301000-memory.dmp

Download

memory/4112-372-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/4112-380-0x0000000005040000-0x00000000050EC000-memory.dmp

Download

memory/4112-369-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/4112-363-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/4112-365-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/4116-211-0x0000000004C70000-0x0000000004C8A000-memory.dmp

Download

memory/4116-223-0x0000000000400000-0x0000000002CCD000-memory.dmp

Download

memory/4116-229-0x0000000007423000-0x0000000007424000-memory.dmp

Download

memory/4116-224-0x0000000007420000-0x0000000007421000-memory.dmp

Download

memory/4116-208-0x0000000007430000-0x0000000007431000-memory.dmp

Download

memory/4116-244-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

Download

memory/4116-227-0x0000000007424000-0x0000000007426000-memory.dmp

Download

memory/4116-207-0x0000000004BE0000-0x0000000004BFC000-memory.dmp

Download

memory/4116-203-0x0000000002D20000-0x0000000002D4F000-memory.dmp

Download

memory/4116-226-0x0000000007422000-0x0000000007423000-memory.dmp

Download

memory/4116-221-0x00000000072D0000-0x00000000072D1000-memory.dmp

Download

memory/4116-217-0x0000000007930000-0x0000000007931000-memory.dmp

Download

memory/4116-220-0x00000000072B0000-0x00000000072B1000-memory.dmp

Download

memory/4208-190-0x00000000013F0000-0x00000000013F2000-memory.dmp

Download

memory/4208-179-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/4208-185-0x00000000011E0000-0x00000000011FC000-memory.dmp

Download

memory/4220-231-0x0000000004370000-0x00000000044AF000-memory.dmp

Download

memory/4248-250-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/4248-259-0x000000001BA30000-0x000000001BA32000-memory.dmp

Download

memory/4300-187-0x0000000002AC0000-0x0000000002AC2000-memory.dmp

Download

memory/4300-183-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/4408-367-0x00000000048B0000-0x00000000048DF000-memory.dmp

Download

memory/4888-215-0x0000000000310000-0x0000000000311000-memory.dmp

Download

memory/5032-234-0x0000000000470000-0x0000000000471000-memory.dmp

Download

memory/5084-239-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/5084-253-0x0000000000CA0000-0x0000000000CBC000-memory.dmp

Download

memory/5084-263-0x0000000001020000-0x0000000001022000-memory.dmp

Download

memory/5408-423-0x0000000001610000-0x0000000001612000-memory.dmp

Download