redline | 4d6904b252c292f5aefe176877720e6e8520c977c9f27ba46c92e5a0b6796016

Resubmissions

02-04-2024 09:25

240402-ldsrksdb67 10

24-08-2021 04:56

210824-sewqk7n826 10

Analysis

max time kernel
6s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
24-08-2021 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A56C0274E6EA9BD32141634A92052D91.exe
Size

4.1MB
MD5

a56c0274e6ea9bd32141634a92052d91
SHA1

0f69b4fcbda90184075b84d12217abbd0c07d704
SHA256

4d6904b252c292f5aefe176877720e6e8520c977c9f27ba46c92e5a0b6796016
SHA512

c21c368a8d9e59b61ddb409958b071f206bc1c10e42b1a378a6b32b01fa4a9e107d1b840a0351a2ef3c787881e87d842ae12bd4c49050feb2dab5c7247088526

Score

10^/10

redline smokeloader socelars vidar 706 pub1 aspackv2 backdoor infostealer persistence stealer themida trojan

Malware Config

Extracted

Family

redline

Botnet

pub1

viacetequn.site:80

Extracted

Family

vidar

Version

40.1

Botnet

706

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	204	rundll32.exe	122

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab79-247.dat	family_redline
behavioral2/files/0x000100000001ab7a-244.dat	family_redline
behavioral2/files/0x000100000001ab7a-273.dat	family_redline
behavioral2/memory/3292-271-0x0000000007200000-0x000000000721A000-memory.dmp	family_redline
behavioral2/files/0x000100000001ab79-274.dat	family_redline
behavioral2/memory/3292-253-0x0000000004C50000-0x0000000004C6C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00040000000155fd-222.dat	family_socelars
behavioral2/files/0x00040000000155fd-223.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3448-260-0x0000000000400000-0x0000000002D0E000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000100000001ab69-120.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab6a-119.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab6c-126.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab6c-125.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab69-123.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab69-122.dat	aspack_v212_v242
behavioral2/files/0x000100000001ab6a-121.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
2448	setup_install.exe
2736	Fri17e57b57304ad6467.exe
1668	Fri17f148864b7f11.exe
3948	Fri17935370d9f965.exe
1956	h_kkjott82XPtU_bVCu99pLp.exe
2740	Fri1743bf1fe022.exe
3448	Fri17c3ec4b03a0d8e6.exe
3292	Fri17523e6b49e.exe
4128	Fri17384323b14.exe
4168	Fri17e57b57304ad6467.exe
4200	Fri17bbd34709019a06.exe

Loads dropped DLL 8 IoCs

pid	Process
2448	setup_install.exe
2448	setup_install.exe
2448	setup_install.exe
2448	setup_install.exe
2448	setup_install.exe
2448	setup_install.exe
2448	setup_install.exe
2448	setup_install.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000100000001ab79-247.dat	themida
behavioral2/files/0x000100000001ab7a-244.dat	themida
behavioral2/files/0x000100000001ab7a-273.dat	themida
behavioral2/files/0x000100000001ab79-274.dat	themida
behavioral2/memory/2408-319-0x0000000001180000-0x0000000001181000-memory.dmp	themida
behavioral2/memory/908-308-0x00000000011E0000-0x00000000011E1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Fri17384323b14.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Fri17384323b14.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com
32	ipinfo.io
33	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2192	3448	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1880	powershell.exe
1880	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	Fri17bbd34709019a06.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1956	h_kkjott82XPtU_bVCu99pLp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2448	3904	A56C0274E6EA9BD32141634A92052D91.exe	75
PID 3904 wrote to memory of 2448	3904	A56C0274E6EA9BD32141634A92052D91.exe	75
PID 3904 wrote to memory of 2448	3904	A56C0274E6EA9BD32141634A92052D91.exe	75
PID 2448 wrote to memory of 4076	2448	setup_install.exe	81
PID 2448 wrote to memory of 4076	2448	setup_install.exe	81
PID 2448 wrote to memory of 4076	2448	setup_install.exe	81
PID 2448 wrote to memory of 3676	2448	setup_install.exe	79
PID 2448 wrote to memory of 3676	2448	setup_install.exe	79
PID 2448 wrote to memory of 3676	2448	setup_install.exe	79
PID 2448 wrote to memory of 3984	2448	setup_install.exe	80
PID 2448 wrote to memory of 3984	2448	setup_install.exe	80
PID 2448 wrote to memory of 3984	2448	setup_install.exe	80
PID 3676 wrote to memory of 2736	3676	cmd.exe	82
PID 3676 wrote to memory of 2736	3676	cmd.exe	82
PID 3676 wrote to memory of 2736	3676	cmd.exe	82
PID 2448 wrote to memory of 3324	2448	setup_install.exe	83
PID 2448 wrote to memory of 3324	2448	setup_install.exe	83
PID 2448 wrote to memory of 3324	2448	setup_install.exe	83
PID 2448 wrote to memory of 3636	2448	setup_install.exe	84
PID 2448 wrote to memory of 3636	2448	setup_install.exe	84
PID 2448 wrote to memory of 3636	2448	setup_install.exe	84
PID 2448 wrote to memory of 2156	2448	setup_install.exe	88
PID 2448 wrote to memory of 2156	2448	setup_install.exe	88
PID 2448 wrote to memory of 2156	2448	setup_install.exe	88
PID 2448 wrote to memory of 1792	2448	setup_install.exe	85
PID 2448 wrote to memory of 1792	2448	setup_install.exe	85
PID 2448 wrote to memory of 1792	2448	setup_install.exe	85
PID 2448 wrote to memory of 3176	2448	setup_install.exe	86
PID 2448 wrote to memory of 3176	2448	setup_install.exe	86
PID 2448 wrote to memory of 3176	2448	setup_install.exe	86
PID 2448 wrote to memory of 2092	2448	setup_install.exe	87
PID 2448 wrote to memory of 2092	2448	setup_install.exe	87
PID 2448 wrote to memory of 2092	2448	setup_install.exe	87
PID 2448 wrote to memory of 3876	2448	setup_install.exe	96
PID 2448 wrote to memory of 3876	2448	setup_install.exe	96
PID 2448 wrote to memory of 3876	2448	setup_install.exe	96
PID 4076 wrote to memory of 1880	4076	cmd.exe	95
PID 4076 wrote to memory of 1880	4076	cmd.exe	95
PID 4076 wrote to memory of 1880	4076	cmd.exe	95
PID 3324 wrote to memory of 1668	3324	cmd.exe	89
PID 3324 wrote to memory of 1668	3324	cmd.exe	89
PID 3176 wrote to memory of 1956	3176	cmd.exe	94
PID 3176 wrote to memory of 1956	3176	cmd.exe	94
PID 3984 wrote to memory of 3948	3984	cmd.exe	90
PID 3984 wrote to memory of 3948	3984	cmd.exe	90
PID 3984 wrote to memory of 3948	3984	cmd.exe	90
PID 1792 wrote to memory of 2740	1792	cmd.exe	91
PID 1792 wrote to memory of 2740	1792	cmd.exe	91
PID 1792 wrote to memory of 2740	1792	cmd.exe	91
PID 3636 wrote to memory of 3448	3636	cmd.exe	93
PID 3636 wrote to memory of 3448	3636	cmd.exe	93
PID 3636 wrote to memory of 3448	3636	cmd.exe	93
PID 2156 wrote to memory of 3292	2156	cmd.exe	92
PID 2156 wrote to memory of 3292	2156	cmd.exe	92
PID 2156 wrote to memory of 3292	2156	cmd.exe	92
PID 2092 wrote to memory of 4128	2092	cmd.exe	97
PID 2092 wrote to memory of 4128	2092	cmd.exe	97
PID 2092 wrote to memory of 4128	2092	cmd.exe	97
PID 2736 wrote to memory of 4168	2736	Fri17e57b57304ad6467.exe	98
PID 2736 wrote to memory of 4168	2736	Fri17e57b57304ad6467.exe	98
PID 2736 wrote to memory of 4168	2736	Fri17e57b57304ad6467.exe	98
PID 3876 wrote to memory of 4200	3876	cmd.exe	99
PID 3876 wrote to memory of 4200	3876	cmd.exe	99
PID 4128 wrote to memory of 4348	4128	Fri17384323b14.exe	115

C:\Users\Admin\AppData\Local\Temp\A56C0274E6EA9BD32141634A92052D91.exe
"C:\Users\Admin\AppData\Local\Temp\A56C0274E6EA9BD32141634A92052D91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\7zS04F20934\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS04F20934\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17e57b57304ad6467.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17e57b57304ad6467.exe
      Fri17e57b57304ad6467.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17e57b57304ad6467.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17e57b57304ad6467.exe" -a
        5⤵
        Executes dropped EXE
        
        PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17935370d9f965.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17935370d9f965.exe
      Fri17935370d9f965.exe
      4⤵
      Executes dropped EXE
      PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17f148864b7f11.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17f148864b7f11.exe
      Fri17f148864b7f11.exe
      4⤵
      Executes dropped EXE
      PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17c3ec4b03a0d8e6.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17c3ec4b03a0d8e6.exe
      Fri17c3ec4b03a0d8e6.exe
      4⤵
      Executes dropped EXE
      PID:3448
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 768
        5⤵
        Program crash
        
        PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri1743bf1fe022.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri1743bf1fe022.exe
      Fri1743bf1fe022.exe
      4⤵
      Executes dropped EXE
      PID:2740
    - - C:\Users\Admin\Documents\tALY2fAko2mV_KEBmU2wo8Zd.exe
        
        "C:\Users\Admin\Documents\tALY2fAko2mV_KEBmU2wo8Zd.exe"
        5⤵
        
        PID:908
    - - C:\Users\Admin\Documents\_iOz7r_OjBTOIL4TIGlkSfMF.exe
        
        "C:\Users\Admin\Documents\_iOz7r_OjBTOIL4TIGlkSfMF.exe"
        5⤵
        
        PID:900
    - - C:\Users\Admin\Documents\ymPL7X1BWgF78CAwcdl13mPL.exe
        
        "C:\Users\Admin\Documents\ymPL7X1BWgF78CAwcdl13mPL.exe"
        5⤵
        
        PID:2408
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4348
    - - C:\Users\Admin\Documents\h_kkjott82XPtU_bVCu99pLp.exe
        
        "C:\Users\Admin\Documents\h_kkjott82XPtU_bVCu99pLp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1956
    - - C:\Users\Admin\Documents\dIek_68lg3Zy8rs7IyYZHnZ6.exe
        
        "C:\Users\Admin\Documents\dIek_68lg3Zy8rs7IyYZHnZ6.exe"
        5⤵
        
        PID:1556
    - - C:\Users\Admin\Documents\aFALIvGfNg6UqFPzK3QZj0iz.exe
        
        "C:\Users\Admin\Documents\aFALIvGfNg6UqFPzK3QZj0iz.exe"
        5⤵
        
        PID:1768
    - - C:\Users\Admin\Documents\tdi7WkkGerW4gVpPg3Bnhsd9.exe
        
        "C:\Users\Admin\Documents\tdi7WkkGerW4gVpPg3Bnhsd9.exe"
        5⤵
        
        PID:4652
    - - C:\Users\Admin\Documents\ocFuWUz9XRlOFAxMUjMv70m4.exe
        
        "C:\Users\Admin\Documents\ocFuWUz9XRlOFAxMUjMv70m4.exe"
        5⤵
        
        PID:2696
    - - C:\Users\Admin\Documents\OS4XBWi5zDcy8gv99nebrWvo.exe
        
        "C:\Users\Admin\Documents\OS4XBWi5zDcy8gv99nebrWvo.exe"
        5⤵
        
        PID:188
    - - C:\Users\Admin\Documents\bXckbwmIxvONDbfrPrpq11R5.exe
        
        "C:\Users\Admin\Documents\bXckbwmIxvONDbfrPrpq11R5.exe"
        5⤵
        
        PID:5024
    - - C:\Users\Admin\Documents\Gy9wz7Yw_N5EWNRlYzultne6.exe
        
        "C:\Users\Admin\Documents\Gy9wz7Yw_N5EWNRlYzultne6.exe"
        5⤵
        
        PID:2808
    - - C:\Users\Admin\Documents\zP_DX3lpLhhMTl0OgCkL8vqY.exe
        
        "C:\Users\Admin\Documents\zP_DX3lpLhhMTl0OgCkL8vqY.exe"
        5⤵
        
        PID:3660
    - - C:\Users\Admin\Documents\PQeiNksCsd7OLiJAOFoQ9b0P.exe
        
        "C:\Users\Admin\Documents\PQeiNksCsd7OLiJAOFoQ9b0P.exe"
        5⤵
        
        PID:684
    - - C:\Users\Admin\Documents\lM6axpCMJqUlM5tRdB27XCWc.exe
        
        "C:\Users\Admin\Documents\lM6axpCMJqUlM5tRdB27XCWc.exe"
        5⤵
        
        PID:4708
    - - C:\Users\Admin\Documents\pHqxK7MpFoxy2jGETjFLDJRV.exe
        
        "C:\Users\Admin\Documents\pHqxK7MpFoxy2jGETjFLDJRV.exe"
        5⤵
        
        PID:4508
    - - C:\Users\Admin\Documents\JELoPhVYmZapkQNV2jxnQZFq.exe
        
        "C:\Users\Admin\Documents\JELoPhVYmZapkQNV2jxnQZFq.exe"
        5⤵
        
        PID:4392
    - - C:\Users\Admin\Documents\PqNwUSlLcq7ieNlP_kZcZf9_.exe
        
        "C:\Users\Admin\Documents\PqNwUSlLcq7ieNlP_kZcZf9_.exe"
        5⤵
        
        PID:3984
    - - C:\Users\Admin\Documents\NPu4DKIaDMpuKIORpt1zfFb8.exe
        
        "C:\Users\Admin\Documents\NPu4DKIaDMpuKIORpt1zfFb8.exe"
        5⤵
        
        PID:3956
    - - C:\Users\Admin\Documents\criFjOh2Qslh90lUmz_eIuq_.exe
        
        "C:\Users\Admin\Documents\criFjOh2Qslh90lUmz_eIuq_.exe"
        5⤵
        
        PID:192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17db701d83a67.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17db701d83a67.exe
      Fri17db701d83a67.exe
      4⤵
      PID:1956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17384323b14.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17384323b14.exe
      Fri17384323b14.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Windows\SysWOW64\dllhost.exe
        
        dllhost.exe
        5⤵
        
        PID:4348
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c cmd < Abbassero.wmv
        5⤵
        
        PID:4404
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        6⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com
        
        Piu.exe.com L
        7⤵
        
        PID:3720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17523e6b49e.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17523e6b49e.exe
      Fri17523e6b49e.exe
      4⤵
      Executes dropped EXE
      PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Fri17bbd34709019a06.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\7zS04F20934\Fri17bbd34709019a06.exe
      Fri17bbd34709019a06.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        5⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Chrome3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome3.exe"
        6⤵
        
        PID:4796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
        7⤵
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1.exe"
        6⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3.exe"
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        6⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6.exe"
        6⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        6⤵
        
        PID:4856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:812

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-323-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/192-320-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/192-310-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/908-308-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/908-299-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/1556-309-0x00000000017B0000-0x00000000017B2000-memory.dmp

Filesize
8KB

Download
memory/1556-296-0x00000000016A0000-0x00000000016BC000-memory.dmp

Filesize
112KB

Download
memory/1556-267-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/1668-196-0x0000017556720000-0x0000017556804000-memory.dmp

Filesize
912KB

Download
memory/1668-197-0x0000017556970000-0x0000017556AD1000-memory.dmp

Filesize
1.4MB

Download
memory/1880-192-0x0000000007D50000-0x0000000007D51000-memory.dmp

Filesize
4KB

Download
memory/1880-208-0x00000000076D0000-0x00000000076D1000-memory.dmp

Filesize
4KB

Download
memory/1880-181-0x0000000007720000-0x0000000007721000-memory.dmp

Filesize
4KB

Download
memory/1880-209-0x00000000088F0000-0x00000000088F1000-memory.dmp

Filesize
4KB

Download
memory/1880-185-0x00000000070E2000-0x00000000070E3000-memory.dmp

Filesize
4KB

Download
memory/1880-195-0x0000000008010000-0x0000000008011000-memory.dmp

Filesize
4KB

Download
memory/1880-182-0x00000000070E0000-0x00000000070E1000-memory.dmp

Filesize
4KB

Download
memory/1880-193-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

Filesize
4KB

Download
memory/1880-189-0x0000000007510000-0x0000000007511000-memory.dmp

Filesize
4KB

Download
memory/1880-178-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1880-218-0x00000000086B0000-0x00000000086B1000-memory.dmp

Filesize
4KB

Download
memory/1956-175-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1956-194-0x000000001B200000-0x000000001B202000-memory.dmp

Filesize
8KB

Download
memory/1956-187-0x0000000000900000-0x000000000091C000-memory.dmp

Filesize
112KB

Download
memory/2408-319-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/2408-305-0x00000000774C0000-0x000000007764E000-memory.dmp

Filesize
1.6MB

Download
memory/2448-152-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2448-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2448-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2448-141-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2448-149-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2448-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2448-144-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2740-204-0x0000000003850000-0x000000000398F000-memory.dmp

Filesize
1.2MB

Download
memory/2996-283-0x0000000000730000-0x0000000000746000-memory.dmp

Filesize
88KB

Download
memory/3292-290-0x0000000007240000-0x0000000007241000-memory.dmp

Filesize
4KB

Download
memory/3292-253-0x0000000004C50000-0x0000000004C6C000-memory.dmp

Filesize
112KB

Download
memory/3292-325-0x0000000008260000-0x0000000008261000-memory.dmp

Filesize
4KB

Download
memory/3292-285-0x0000000007DD0000-0x0000000007DD1000-memory.dmp

Filesize
4KB

Download
memory/3292-257-0x0000000000400000-0x0000000002CCD000-memory.dmp

Filesize
40.8MB

Download
memory/3292-300-0x0000000007244000-0x0000000007246000-memory.dmp

Filesize
8KB

Download
memory/3292-229-0x0000000002CD0000-0x0000000002E1A000-memory.dmp

Filesize
1.3MB

Download
memory/3292-281-0x0000000007750000-0x0000000007751000-memory.dmp

Filesize
4KB

Download
memory/3292-291-0x0000000007DF0000-0x0000000007DF1000-memory.dmp

Filesize
4KB

Download
memory/3292-271-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/3292-270-0x0000000007243000-0x0000000007244000-memory.dmp

Filesize
4KB

Download
memory/3292-266-0x0000000007250000-0x0000000007251000-memory.dmp

Filesize
4KB

Download
memory/3292-265-0x0000000007242000-0x0000000007243000-memory.dmp

Filesize
4KB

Download
memory/3448-260-0x0000000000400000-0x0000000002D0E000-memory.dmp

Filesize
41.1MB

Download
memory/3448-232-0x0000000002DE0000-0x0000000002F2A000-memory.dmp

Filesize
1.3MB

Download
memory/3948-295-0x0000000000400000-0x0000000002CB2000-memory.dmp

Filesize
40.7MB

Download
memory/3948-241-0x0000000002DA0000-0x0000000002DA9000-memory.dmp

Filesize
36KB

Download
memory/4200-191-0x000000001B710000-0x000000001B712000-memory.dmp

Filesize
8KB

Download
memory/4200-184-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/4392-303-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/4392-324-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4700-206-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/4796-280-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/4796-276-0x00000000008F0000-0x00000000008FA000-memory.dmp

Filesize
40KB

Download
memory/4796-213-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/4796-277-0x000000001C4E0000-0x000000001C4E2000-memory.dmp

Filesize
8KB

Download
memory/4848-224-0x0000000000CE0000-0x0000000000CFC000-memory.dmp

Filesize
112KB

Download
memory/4848-219-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/4848-236-0x000000001B2E0000-0x000000001B2E2000-memory.dmp

Filesize
8KB

Download
memory/4856-275-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/4856-286-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/5008-228-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/5008-235-0x000000001B9E0000-0x000000001B9E2000-memory.dmp

Filesize
8KB

Download