redline | 01f4e7e10bb524b04e6c8e731f51b600ad5948e1001531b05df57eb3c5f2d0ef

Analysis

max time kernel
17s
max time network
153s
platform
windows7_x64
resource
win7-en
submitted
03/09/2021, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
Size 4.3MB
Sample210903-rlqvvagean
SHA256 01f4e7e10bb524b04e6c8e731f51b600ad5948e1001531b05df57eb3c5f2d0ef
MD5 f69bb2af3dbb3fac27f3cfffddf2993b
SHA1 f58415b8c6eb9d3bdbd8661423eb00c67d8411c0
SHA512 2938a9e5c15906df8730b1ae519e117001d1c5e9c45094860c1597cdbadc22ce079e460b124a7d9820204790efbda2deb4442fd54201f1b575f44ab271210128
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader vidar 706 pub1 aspackv2 backdoor infostealer persistence stealer themida trojan

Malware Config

Extracted

Family

vidar

Version

40.1

Botnet

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

pub1

viacetequn.site:80

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	1188	rundll32.exe	57

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1200-183-0x0000000003270000-0x000000000328C000-memory.dmp	family_redline
behavioral1/memory/1200-187-0x0000000004D00000-0x0000000004D1A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1612-169-0x0000000000400000-0x0000000002403000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0001000000012f18-60.dat	aspack_v212_v242
behavioral1/files/0x0001000000012f18-61.dat	aspack_v212_v242
behavioral1/files/0x0002000000012f13-62.dat	aspack_v212_v242
behavioral1/files/0x0002000000012f13-63.dat	aspack_v212_v242
behavioral1/files/0x0001000000012f1a-66.dat	aspack_v212_v242
behavioral1/files/0x0001000000012f1a-67.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1720	setup_install.exe
1140	Sat049cec745dbb0.exe
1448	Sat04b0aea94c969aef.exe
1612	Sat04ab282c33a66.exe
1708	Sat04c6bdf900.exe
1200	Sat049403b078c3b419d.exe
1088	Sat049cec745dbb0.exe
1728	Sat04427cb01d4e20c.exe
316	Sat04c6bdf900.exe
1124	Sat041c77a5398.exe
1696	Sat0474d386f5494e4ae.exe
636	Sat045c58e4987b928d.exe

Loads dropped DLL 38 IoCs

pid	Process
1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1720	setup_install.exe
1768	cmd.exe
1768	cmd.exe
112	cmd.exe
112	cmd.exe
1140	Sat049cec745dbb0.exe
1140	Sat049cec745dbb0.exe
1600	cmd.exe
1600	cmd.exe
1448	Sat04b0aea94c969aef.exe
1448	Sat04b0aea94c969aef.exe
896	cmd.exe
896	cmd.exe
1140	Sat049cec745dbb0.exe
1612	Sat04ab282c33a66.exe
1612	Sat04ab282c33a66.exe
704	cmd.exe
1200	Sat049403b078c3b419d.exe
1200	Sat049403b078c3b419d.exe
1336	cmd.exe
932	cmd.exe
1696	Sat0474d386f5494e4ae.exe
1696	Sat0474d386f5494e4ae.exe
1108	cmd.exe
636	Sat045c58e4987b928d.exe
636	Sat045c58e4987b928d.exe
1088	Sat049cec745dbb0.exe
1088	Sat049cec745dbb0.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2448-241-0x0000000000AF0000-0x0000000000AF1000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Sat045c58e4987b928d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Sat045c58e4987b928d.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ipinfo.io
32	ipinfo.io
166	ipinfo.io
167	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2508	1612	WerFault.exe	44

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat04b0aea94c969aef.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat04b0aea94c969aef.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Sat04b0aea94c969aef.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
1448	Sat04b0aea94c969aef.exe
1448	Sat04b0aea94c969aef.exe
268	powershell.exe
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1448	Sat04b0aea94c969aef.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	Sat041c77a5398.exe
Token: SeDebugPrivilege	268	powershell.exe

Suspicious use of FindShellTrayWindow 17 IoCs

pid	Process
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found
1376	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1632 wrote to memory of 1720	1632	F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe	26
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1572	1720	setup_install.exe	28
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 1768	1720	setup_install.exe	50
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 112	1720	setup_install.exe	49
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1720 wrote to memory of 1636	1720	setup_install.exe	48
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1768 wrote to memory of 1140	1768	cmd.exe	47
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1572 wrote to memory of 268	1572	cmd.exe	29
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 1720 wrote to memory of 1600	1720	setup_install.exe	46
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 112 wrote to memory of 1448	112	cmd.exe	30
PID 1720 wrote to memory of 896	1720	setup_install.exe	45

C:\Users\Admin\AppData\Local\Temp\F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe
"C:\Users\Admin\AppData\Local\Temp\F69BB2AF3DBB3FAC27F3CFFFDDF2993B.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat0474d386f5494e4ae.exe
    3⤵
    - Loads dropped DLL
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat0474d386f5494e4ae.exe
      Sat0474d386f5494e4ae.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1696
    - - C:\Users\Admin\Documents\RKJNjOyqDTrI8vbjoGzIWCXV.exe
        
        "C:\Users\Admin\Documents\RKJNjOyqDTrI8vbjoGzIWCXV.exe"
        5⤵
        
        PID:2448
    - - C:\Users\Admin\Documents\ZD0iTSFKlQOozMPYCwhl1zPt.exe
        
        "C:\Users\Admin\Documents\ZD0iTSFKlQOozMPYCwhl1zPt.exe"
        5⤵
        
        PID:2436
    - - C:\Users\Admin\Documents\Sjx69ZxtnTQkAG0OMwQNAdAg.exe
        
        "C:\Users\Admin\Documents\Sjx69ZxtnTQkAG0OMwQNAdAg.exe"
        5⤵
        
        PID:2424
    - - C:\Users\Admin\Documents\MrMPC4naAOkI80ZDCsUKQxaS.exe
        
        "C:\Users\Admin\Documents\MrMPC4naAOkI80ZDCsUKQxaS.exe"
        5⤵
        
        PID:2412
    - - C:\Users\Admin\Documents\lIyQc_LgHzxpJhHD8UaFvAt0.exe
        
        "C:\Users\Admin\Documents\lIyQc_LgHzxpJhHD8UaFvAt0.exe"
        5⤵
        
        PID:2584
    - - C:\Users\Admin\Documents\qNM9t8U5F1GoBDiDECTnAKz1.exe
        
        "C:\Users\Admin\Documents\qNM9t8U5F1GoBDiDECTnAKz1.exe"
        5⤵
        
        PID:2576
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\qNM9t8U5F1GoBDiDECTnAKz1.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\qNM9t8U5F1GoBDiDECTnAKz1.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        6⤵
        
        PID:2736
    - - C:\Users\Admin\Documents\CEtfkie7Tu8bsFLHQJ55F0US.exe
        
        "C:\Users\Admin\Documents\CEtfkie7Tu8bsFLHQJ55F0US.exe"
        5⤵
        
        PID:2560
    - - C:\Users\Admin\Documents\FmtLU4B76MWrmquJJhWeOjZf.exe
        
        "C:\Users\Admin\Documents\FmtLU4B76MWrmquJJhWeOjZf.exe"
        5⤵
        
        PID:2548
    - - C:\Users\Admin\Documents\HnGRYKygkeSBK1rlMSQsLQPs.exe
        
        "C:\Users\Admin\Documents\HnGRYKygkeSBK1rlMSQsLQPs.exe"
        5⤵
        
        PID:2536
    - - C:\Users\Admin\Documents\OvtlqA0WigNKZ7xPNmfJqwRc.exe
        
        "C:\Users\Admin\Documents\OvtlqA0WigNKZ7xPNmfJqwRc.exe"
        5⤵
        
        PID:2524
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "OvtlqA0WigNKZ7xPNmfJqwRc.exe" /f & erase "C:\Users\Admin\Documents\OvtlqA0WigNKZ7xPNmfJqwRc.exe" & exit
        6⤵
        
        PID:2160
    - - C:\Users\Admin\Documents\qK1ykVIxVt9wnanPgZaOR6I8.exe
        
        "C:\Users\Admin\Documents\qK1ykVIxVt9wnanPgZaOR6I8.exe"
        5⤵
        
        PID:2484
    - - C:\Users\Admin\Documents\3dXeKW90wZXrnHlREOYCPIxL.exe
        
        "C:\Users\Admin\Documents\3dXeKW90wZXrnHlREOYCPIxL.exe"
        5⤵
        
        PID:2764
    - - C:\Users\Admin\Documents\rOdQuwOIMdFXlyDDDXNyYHMI.exe
        
        "C:\Users\Admin\Documents\rOdQuwOIMdFXlyDDDXNyYHMI.exe"
        5⤵
        
        PID:2644
    - - C:\Users\Admin\Documents\HyjCVWr8geNFTlHkbbL6vtDj.exe
        
        "C:\Users\Admin\Documents\HyjCVWr8geNFTlHkbbL6vtDj.exe"
        5⤵
        
        PID:2824
    - - C:\Users\Admin\Documents\He5sNTcERliNTrwO2NTvBTn2.exe
        
        "C:\Users\Admin\Documents\He5sNTcERliNTrwO2NTvBTn2.exe"
        5⤵
        
        PID:2856
    - - C:\Users\Admin\Documents\xMmxY6kDF2X7SF1_QYSMxCgb.exe
        
        "C:\Users\Admin\Documents\xMmxY6kDF2X7SF1_QYSMxCgb.exe"
        5⤵
        
        PID:2920
    - - C:\Users\Admin\Documents\PGAYMRVwp1Hphgkm6yiL4d_C.exe
        
        "C:\Users\Admin\Documents\PGAYMRVwp1Hphgkm6yiL4d_C.exe"
        5⤵
        
        PID:2908
    - - C:\Users\Admin\Documents\oD9uP69TlK5z85KE2S073KdS.exe
        
        "C:\Users\Admin\Documents\oD9uP69TlK5z85KE2S073KdS.exe"
        5⤵
        
        PID:2892
    - - C:\Users\Admin\Documents\kjWEKIzVjILXIWpBHtXZU3N9.exe
        
        "C:\Users\Admin\Documents\kjWEKIzVjILXIWpBHtXZU3N9.exe"
        5⤵
        
        PID:2880
    - - C:\Users\Admin\Documents\3_U1bpVTsmluEVstj3eRDOIR.exe
        
        "C:\Users\Admin\Documents\3_U1bpVTsmluEVstj3eRDOIR.exe"
        5⤵
        
        PID:2872
      - C:\Users\Admin\Documents\3_U1bpVTsmluEVstj3eRDOIR.exe
        
        C:\Users\Admin\Documents\3_U1bpVTsmluEVstj3eRDOIR.exe
        6⤵
        
        PID:1484
    - - C:\Users\Admin\Documents\o0rUBdLqXV0wekUVqTQhyDep.exe
        
        "C:\Users\Admin\Documents\o0rUBdLqXV0wekUVqTQhyDep.exe"
        5⤵
        
        PID:2848
    - - C:\Users\Admin\Documents\IMkeDL7hUZNi1LcJfU14ciVU.exe
        
        "C:\Users\Admin\Documents\IMkeDL7hUZNi1LcJfU14ciVU.exe"
        5⤵
        
        PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat04427cb01d4e20c.exe
    3⤵
    - Loads dropped DLL
    PID:704
  - - C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat04427cb01d4e20c.exe
      Sat04427cb01d4e20c.exe
      4⤵
      Executes dropped EXE
      PID:1728
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat041c77a5398.exe
    3⤵
    - Loads dropped DLL
    PID:1336
  - - C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat041c77a5398.exe
      Sat041c77a5398.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat045c58e4987b928d.exe
    3⤵
    - Loads dropped DLL
    PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat049403b078c3b419d.exe
    3⤵
    - Loads dropped DLL
    PID:896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat04ab282c33a66.exe
    3⤵
    - Loads dropped DLL
    PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat04c6bdf900.exe
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat04b0aea94c969aef.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Sat049cec745dbb0.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1768

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat04b0aea94c969aef.exe
Sat04b0aea94c969aef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1448

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat04c6bdf900.exe
"C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat04c6bdf900.exe"
1⤵
- Executes dropped EXE
PID:316

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat049cec745dbb0.exe
"C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat049cec745dbb0.exe" -a
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat045c58e4987b928d.exe
Sat045c58e4987b928d.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:636
- C:\Windows\SysWOW64\dllhost.exe
  dllhost.exe
  2⤵
  PID:1112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cmd < Abbassero.wmv
  2⤵
  PID:1704

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat04c6bdf900.exe
Sat04c6bdf900.exe
1⤵
- Executes dropped EXE
PID:1708

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat049403b078c3b419d.exe
Sat049403b078c3b419d.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat04ab282c33a66.exe
Sat04ab282c33a66.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 1004
  2⤵
  - Program crash
  PID:2508

C:\Users\Admin\AppData\Local\Temp\7zS066F74E3\Sat049cec745dbb0.exe
Sat049cec745dbb0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-172-0x00000000020E0000-0x0000000002D2A000-memory.dmp

Download

memory/1124-165-0x0000000001050000-0x0000000001051000-memory.dmp

Download

memory/1124-173-0x000000001B1F0000-0x000000001B1F2000-memory.dmp

Download

memory/1200-180-0x0000000000400000-0x0000000002CCD000-memory.dmp

Download

memory/1200-183-0x0000000003270000-0x000000000328C000-memory.dmp

Download

memory/1200-186-0x00000000073F3000-0x00000000073F4000-memory.dmp

Download

memory/1200-185-0x00000000073F2000-0x00000000073F3000-memory.dmp

Download

memory/1200-188-0x00000000073F4000-0x00000000073F6000-memory.dmp

Download

memory/1200-179-0x0000000000250000-0x000000000027F000-memory.dmp

Download

memory/1200-182-0x00000000073F1000-0x00000000073F2000-memory.dmp

Download

memory/1200-187-0x0000000004D00000-0x0000000004D1A000-memory.dmp

Download

memory/1376-184-0x0000000003A30000-0x0000000003A46000-memory.dmp

Download

memory/1448-170-0x0000000000240000-0x0000000000249000-memory.dmp

Download

memory/1448-168-0x0000000000400000-0x00000000023AF000-memory.dmp

Download

memory/1612-167-0x00000000028C0000-0x00000000048C3000-memory.dmp

Download

memory/1612-169-0x0000000000400000-0x0000000002403000-memory.dmp

Download

memory/1632-52-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Download

memory/1636-181-0x0000000001F00000-0x0000000001F01000-memory.dmp

Download

memory/1696-189-0x0000000003FA0000-0x00000000040DF000-memory.dmp

Download

memory/1720-77-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-86-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-73-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1720-85-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1720-78-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1720-95-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1720-75-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1720-102-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1720-92-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1728-171-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/2448-241-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/2524-218-0x0000000000290000-0x00000000002BF000-memory.dmp

Download

memory/2644-214-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/2872-238-0x00000000000F0000-0x00000000000F1000-memory.dmp

Download