Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
1723s -
max time network
1729s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (13).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
2608
tambisup.com:9825
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2936 2828 rundll32.exe 65 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral9/memory/2080-177-0x0000000002E10000-0x0000000002E2C000-memory.dmp family_redline behavioral9/memory/1352-193-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 24 IoCs
pid Process 920 EBoQIh9tsKfZdTWekqiYbE_k.exe 960 p9oGVvqRNrvexsp1le5yuasd.exe 1536 EtvjMm4A0iYzMcDwqGKBvXIG.exe 944 WmHmrHIej6LaEDab77WRxDp3.exe 1752 6hYu9BWV5HmBFmbOzivHekhR.exe 1576 uawNBV94bVmu_ktkwIrhgAZa.exe 2016 XEqi5uPNoxrUjg9UFdMVjwPe.exe 1816 7QVmb7eIJ1uPEg5cu0OZZbuS.exe 1828 LfhrjWG5r7jRxj_emXgnxyIq.exe 1992 fTJW56UamXJUiLTSeG_TfKnQ.exe 780 e5cZ_4WcieXv0dSjoQHaYZVn.exe 112 rlFudyh1nMKTgfko4bozC6ZL.exe 1872 cql1NVWYoRTjPT1tvL0AaIPL.exe 2056 nvMp58uxCROSmXhH0fMoWZm4.exe 1756 UdXM_levZRzIsFVJbtn90PQZ.exe 2136 J0s8T9DGjm6zwhTRh48pmTmD.exe 340 5RHC22ejj7MHADMdDVSAB9r0.exe 952 Ha7oYNI0TbxnovHvGBty5wgz.exe 2168 fJbGz06epsvFrY6utW2INuGH.exe 2120 DdzmFizdQdNecjC9znBLS2Qf.exe 2080 4FE0BO9BKrYGTNJ8w0GgTHzg.exe 2152 SXL7tMDhREQpaqwXUn7iWW4N.exe 948 xKYKaF0f5SDHxeqMbAOuh_OT.exe 1888 Ou3tPfureT.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion J0s8T9DGjm6zwhTRh48pmTmD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion J0s8T9DGjm6zwhTRh48pmTmD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion LfhrjWG5r7jRxj_emXgnxyIq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion LfhrjWG5r7jRxj_emXgnxyIq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation Setup (13).exe -
Loads dropped DLL 48 IoCs
pid Process 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1288 Setup (13).exe 1756 UdXM_levZRzIsFVJbtn90PQZ.exe 1756 UdXM_levZRzIsFVJbtn90PQZ.exe 1756 UdXM_levZRzIsFVJbtn90PQZ.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2364 WerFault.exe -
resource yara_rule behavioral9/files/0x0003000000013164-81.dat themida behavioral9/files/0x0003000000013164-133.dat themida behavioral9/files/0x0003000000013183-123.dat themida behavioral9/files/0x0003000000013188-125.dat themida behavioral9/files/0x0003000000013188-143.dat themida behavioral9/files/0x0003000000013183-148.dat themida behavioral9/memory/2136-179-0x0000000000DB0000-0x0000000000DB1000-memory.dmp themida behavioral9/memory/1828-180-0x0000000000D10000-0x0000000000D11000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA J0s8T9DGjm6zwhTRh48pmTmD.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LfhrjWG5r7jRxj_emXgnxyIq.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ipinfo.io 22 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2136 J0s8T9DGjm6zwhTRh48pmTmD.exe 1828 LfhrjWG5r7jRxj_emXgnxyIq.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 920 set thread context of 2924 920 EBoQIh9tsKfZdTWekqiYbE_k.exe 66 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 2004 780 WerFault.exe 40 2364 948 WerFault.exe 56 -
Kills process with taskkill 1 IoCs
pid Process 1200 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e xKYKaF0f5SDHxeqMbAOuh_OT.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (13).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (13).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 xKYKaF0f5SDHxeqMbAOuh_OT.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e xKYKaF0f5SDHxeqMbAOuh_OT.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e xKYKaF0f5SDHxeqMbAOuh_OT.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (13).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (13).exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 131 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1288 Setup (13).exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2364 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe 2004 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2004 WerFault.exe 2364 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1992 fTJW56UamXJUiLTSeG_TfKnQ.exe Token: SeDebugPrivilege 1200 taskkill.exe Token: SeDebugPrivilege 2364 WerFault.exe Token: SeDebugPrivilege 2004 WerFault.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 920 1288 Setup (13).exe 31 PID 1288 wrote to memory of 920 1288 Setup (13).exe 31 PID 1288 wrote to memory of 920 1288 Setup (13).exe 31 PID 1288 wrote to memory of 920 1288 Setup (13).exe 31 PID 1288 wrote to memory of 1536 1288 Setup (13).exe 35 PID 1288 wrote to memory of 1536 1288 Setup (13).exe 35 PID 1288 wrote to memory of 1536 1288 Setup (13).exe 35 PID 1288 wrote to memory of 1536 1288 Setup (13).exe 35 PID 1288 wrote to memory of 944 1288 Setup (13).exe 36 PID 1288 wrote to memory of 944 1288 Setup (13).exe 36 PID 1288 wrote to memory of 944 1288 Setup (13).exe 36 PID 1288 wrote to memory of 944 1288 Setup (13).exe 36 PID 1288 wrote to memory of 1752 1288 Setup (13).exe 34 PID 1288 wrote to memory of 1752 1288 Setup (13).exe 34 PID 1288 wrote to memory of 1752 1288 Setup (13).exe 34 PID 1288 wrote to memory of 1752 1288 Setup (13).exe 34 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 1576 1288 Setup (13).exe 33 PID 1288 wrote to memory of 2016 1288 Setup (13).exe 42 PID 1288 wrote to memory of 2016 1288 Setup (13).exe 42 PID 1288 wrote to memory of 2016 1288 Setup (13).exe 42 PID 1288 wrote to memory of 2016 1288 Setup (13).exe 42 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 1828 1288 Setup (13).exe 41 PID 1288 wrote to memory of 780 1288 Setup (13).exe 40 PID 1288 wrote to memory of 780 1288 Setup (13).exe 40 PID 1288 wrote to memory of 780 1288 Setup (13).exe 40 PID 1288 wrote to memory of 780 1288 Setup (13).exe 40 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1816 1288 Setup (13).exe 39 PID 1288 wrote to memory of 1992 1288 Setup (13).exe 37 PID 1288 wrote to memory of 1992 1288 Setup (13).exe 37 PID 1288 wrote to memory of 1992 1288 Setup (13).exe 37 PID 1288 wrote to memory of 1992 1288 Setup (13).exe 37 PID 1288 wrote to memory of 1756 1288 Setup (13).exe 44 PID 1288 wrote to memory of 1756 1288 Setup (13).exe 44 PID 1288 wrote to memory of 1756 1288 Setup (13).exe 44 PID 1288 wrote to memory of 1756 1288 Setup (13).exe 44 PID 1288 wrote to memory of 112 1288 Setup (13).exe 60 PID 1288 wrote to memory of 112 1288 Setup (13).exe 60 PID 1288 wrote to memory of 112 1288 Setup (13).exe 60 PID 1288 wrote to memory of 112 1288 Setup (13).exe 60 PID 1288 wrote to memory of 1400 1288 Setup (13).exe 59 PID 1288 wrote to memory of 1400 1288 Setup (13).exe 59 PID 1288 wrote to memory of 1400 1288 Setup (13).exe 59 PID 1288 wrote to memory of 1400 1288 Setup (13).exe 59 PID 1288 wrote to memory of 1316 1288 Setup (13).exe 58 PID 1288 wrote to memory of 1316 1288 Setup (13).exe 58 PID 1288 wrote to memory of 1316 1288 Setup (13).exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"C:\Users\Admin\AppData\Local\Temp\Setup (13).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\Documents\EBoQIh9tsKfZdTWekqiYbE_k.exe"C:\Users\Admin\Documents\EBoQIh9tsKfZdTWekqiYbE_k.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:920 -
C:\Users\Admin\Documents\EBoQIh9tsKfZdTWekqiYbE_k.exe"C:\Users\Admin\Documents\EBoQIh9tsKfZdTWekqiYbE_k.exe"3⤵PID:2924
-
-
-
C:\Users\Admin\Documents\p9oGVvqRNrvexsp1le5yuasd.exe"C:\Users\Admin\Documents\p9oGVvqRNrvexsp1le5yuasd.exe"2⤵
- Executes dropped EXE
PID:960
-
-
C:\Users\Admin\Documents\uawNBV94bVmu_ktkwIrhgAZa.exe"C:\Users\Admin\Documents\uawNBV94bVmu_ktkwIrhgAZa.exe"2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Users\Admin\Documents\6hYu9BWV5HmBFmbOzivHekhR.exe"C:\Users\Admin\Documents\6hYu9BWV5HmBFmbOzivHekhR.exe"2⤵
- Executes dropped EXE
PID:1752
-
-
C:\Users\Admin\Documents\EtvjMm4A0iYzMcDwqGKBvXIG.exe"C:\Users\Admin\Documents\EtvjMm4A0iYzMcDwqGKBvXIG.exe"2⤵
- Executes dropped EXE
PID:1536
-
-
C:\Users\Admin\Documents\WmHmrHIej6LaEDab77WRxDp3.exe"C:\Users\Admin\Documents\WmHmrHIej6LaEDab77WRxDp3.exe"2⤵
- Executes dropped EXE
PID:944
-
-
C:\Users\Admin\Documents\fTJW56UamXJUiLTSeG_TfKnQ.exe"C:\Users\Admin\Documents\fTJW56UamXJUiLTSeG_TfKnQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
-
C:\Users\Admin\Documents\7QVmb7eIJ1uPEg5cu0OZZbuS.exe"C:\Users\Admin\Documents\7QVmb7eIJ1uPEg5cu0OZZbuS.exe"2⤵
- Executes dropped EXE
PID:1816
-
-
C:\Users\Admin\Documents\e5cZ_4WcieXv0dSjoQHaYZVn.exe"C:\Users\Admin\Documents\e5cZ_4WcieXv0dSjoQHaYZVn.exe"2⤵
- Executes dropped EXE
PID:780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 8603⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
-
C:\Users\Admin\Documents\LfhrjWG5r7jRxj_emXgnxyIq.exe"C:\Users\Admin\Documents\LfhrjWG5r7jRxj_emXgnxyIq.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1828
-
-
C:\Users\Admin\Documents\XEqi5uPNoxrUjg9UFdMVjwPe.exe"C:\Users\Admin\Documents\XEqi5uPNoxrUjg9UFdMVjwPe.exe"2⤵
- Executes dropped EXE
PID:2016
-
-
C:\Users\Admin\Documents\UdXM_levZRzIsFVJbtn90PQZ.exe"C:\Users\Admin\Documents\UdXM_levZRzIsFVJbtn90PQZ.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"3⤵
- Executes dropped EXE
PID:1888 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:1352
-
-
-
-
C:\Users\Admin\Documents\fJbGz06epsvFrY6utW2INuGH.exe"C:\Users\Admin\Documents\fJbGz06epsvFrY6utW2INuGH.exe"2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Users\Admin\Documents\SXL7tMDhREQpaqwXUn7iWW4N.exe"C:\Users\Admin\Documents\SXL7tMDhREQpaqwXUn7iWW4N.exe"2⤵
- Executes dropped EXE
PID:2152
-
-
C:\Users\Admin\Documents\J0s8T9DGjm6zwhTRh48pmTmD.exe"C:\Users\Admin\Documents\J0s8T9DGjm6zwhTRh48pmTmD.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2136
-
-
C:\Users\Admin\Documents\DdzmFizdQdNecjC9znBLS2Qf.exe"C:\Users\Admin\Documents\DdzmFizdQdNecjC9znBLS2Qf.exe"2⤵
- Executes dropped EXE
PID:2120
-
-
C:\Users\Admin\Documents\J6_LE2p1Sl757UjnoJH4CCrk.exe"C:\Users\Admin\Documents\J6_LE2p1Sl757UjnoJH4CCrk.exe"2⤵PID:2100
-
-
C:\Users\Admin\Documents\4FE0BO9BKrYGTNJ8w0GgTHzg.exe"C:\Users\Admin\Documents\4FE0BO9BKrYGTNJ8w0GgTHzg.exe"2⤵
- Executes dropped EXE
PID:2080
-
-
C:\Users\Admin\Documents\nvMp58uxCROSmXhH0fMoWZm4.exe"C:\Users\Admin\Documents\nvMp58uxCROSmXhH0fMoWZm4.exe"2⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nvMp58uxCROSmXhH0fMoWZm4.exe" /f & erase "C:\Users\Admin\Documents\nvMp58uxCROSmXhH0fMoWZm4.exe" & exit3⤵PID:3056
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nvMp58uxCROSmXhH0fMoWZm4.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
-
-
C:\Users\Admin\Documents\5RHC22ejj7MHADMdDVSAB9r0.exe"C:\Users\Admin\Documents\5RHC22ejj7MHADMdDVSAB9r0.exe"2⤵
- Executes dropped EXE
PID:340
-
-
C:\Users\Admin\Documents\cql1NVWYoRTjPT1tvL0AaIPL.exe"C:\Users\Admin\Documents\cql1NVWYoRTjPT1tvL0AaIPL.exe"2⤵
- Executes dropped EXE
PID:1872
-
-
C:\Users\Admin\Documents\H7mL5Xmj9Ft6SBwUUKW3CC15.exe"C:\Users\Admin\Documents\H7mL5Xmj9Ft6SBwUUKW3CC15.exe"2⤵PID:1060
-
-
C:\Users\Admin\Documents\xKYKaF0f5SDHxeqMbAOuh_OT.exe"C:\Users\Admin\Documents\xKYKaF0f5SDHxeqMbAOuh_OT.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 8683⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
-
-
C:\Users\Admin\Documents\Ha7oYNI0TbxnovHvGBty5wgz.exe"C:\Users\Admin\Documents\Ha7oYNI0TbxnovHvGBty5wgz.exe"2⤵
- Executes dropped EXE
PID:952
-
-
C:\Users\Admin\Documents\bExKX8SRRqvjN5S8CSV4F27S.exe"C:\Users\Admin\Documents\bExKX8SRRqvjN5S8CSV4F27S.exe"2⤵PID:1316
-
-
C:\Users\Admin\Documents\qnX4j7Hdsn7bEWQp6YhFdObl.exe"C:\Users\Admin\Documents\qnX4j7Hdsn7bEWQp6YhFdObl.exe"2⤵PID:1400
-
-
C:\Users\Admin\Documents\rlFudyh1nMKTgfko4bozC6ZL.exe"C:\Users\Admin\Documents\rlFudyh1nMKTgfko4bozC6ZL.exe"2⤵
- Executes dropped EXE
PID:112
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2952
-