redline | 8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7v20210408
submitted
05-09-2021 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A75FFC6AB58574119E960EC0B1F72BFD.exe
Size

3.0MB
MD5

a75ffc6ab58574119e960ec0b1f72bfd
SHA1

f7addaaf851436721919294927253726b67ce17b
SHA256

8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab
SHA512

09520fdf40a16790b93b4ef14a0b177bd65956712d874d782c3b902f9a42869d3691aaf6d038468350b0bdc159c6cf376da94af580c4aa6f48250a7e60b99c5d

Score

10^/10

redline smokeloader aspackv2 backdoor infostealer themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2244-223-0x00000000009C0000-0x00000000009EE000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00040000000130ca-68.dat	aspack_v212_v242
behavioral1/files/0x00040000000130ca-69.dat	aspack_v212_v242
behavioral1/files/0x00040000000130c8-70.dat	aspack_v212_v242
behavioral1/files/0x00040000000130c8-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d0-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130d0-75.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
1984	setup_install.exe
1000	Wed069ea7b9fa22d66d.exe
580	Wed068238a49b99.exe
1604	Wed065721111fbde.exe
292	Wed062611295f.exe

Loads dropped DLL 21 IoCs

pid	Process
1496	A75FFC6AB58574119E960EC0B1F72BFD.exe
1496	A75FFC6AB58574119E960EC0B1F72BFD.exe
1496	A75FFC6AB58574119E960EC0B1F72BFD.exe
1984	setup_install.exe
1984	setup_install.exe
1984	setup_install.exe
1984	setup_install.exe
1984	setup_install.exe
1984	setup_install.exe
1984	setup_install.exe
1984	setup_install.exe
572	cmd.exe
1728	cmd.exe
1000	Wed069ea7b9fa22d66d.exe
1000	Wed069ea7b9fa22d66d.exe
600	cmd.exe
600	cmd.exe
1200	cmd.exe
1200	cmd.exe
1888	cmd.exe
1000	Wed069ea7b9fa22d66d.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2452-238-0x0000000000FE0000-0x0000000000FE1000-memory.dmp	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com
32	ipinfo.io
33	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1980	WerFault.exe	51

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1496 wrote to memory of 1984	1496	A75FFC6AB58574119E960EC0B1F72BFD.exe	26
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 1652	1984	setup_install.exe	28
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 572	1984	setup_install.exe	29
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1200	1984	setup_install.exe	30
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 1728	1984	setup_install.exe	31
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 600	1984	setup_install.exe	32
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 1984 wrote to memory of 1792	1984	setup_install.exe	33
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 572 wrote to memory of 1000	572	cmd.exe	48
PID 1728 wrote to memory of 580	1728	cmd.exe	34
PID 1728 wrote to memory of 580	1728	cmd.exe	34
PID 1728 wrote to memory of 580	1728	cmd.exe	34
PID 1728 wrote to memory of 580	1728	cmd.exe	34
PID 1652 wrote to memory of 1456	1652	cmd.exe	35
PID 1652 wrote to memory of 1456	1652	cmd.exe	35
PID 1652 wrote to memory of 1456	1652	cmd.exe	35
PID 1652 wrote to memory of 1456	1652	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\A75FFC6AB58574119E960EC0B1F72BFD.exe
"C:\Users\Admin\AppData\Local\Temp\A75FFC6AB58574119E960EC0B1F72BFD.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\7zS8D586684\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS8D586684\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed069ea7b9fa22d66d.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed069ea7b9fa22d66d.exe
      Wed069ea7b9fa22d66d.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed062611295f.exe
    3⤵
    - Loads dropped DLL
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed062611295f.exe
      Wed062611295f.exe
      4⤵
      Executes dropped EXE
      PID:292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed068238a49b99.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed068238a49b99.exe
      Wed068238a49b99.exe
      4⤵
      Executes dropped EXE
      PID:580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed065721111fbde.exe
    3⤵
    - Loads dropped DLL
    PID:600
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed065721111fbde.exe
      Wed065721111fbde.exe
      4⤵
      Executes dropped EXE
      PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed0660009604.exe
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed06bee4c0f9.exe
    3⤵
    - Loads dropped DLL
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed06bee4c0f9.exe
      Wed06bee4c0f9.exe
      4⤵
      PID:1056
    - - C:\Users\Admin\Documents\2Y8dlhUmcz4Ci6otPwucNEQE.exe
        
        "C:\Users\Admin\Documents\2Y8dlhUmcz4Ci6otPwucNEQE.exe"
        5⤵
        
        PID:2360
    - - C:\Users\Admin\Documents\CKclPLKElHYqpwNQQTHEhxsQ.exe
        
        "C:\Users\Admin\Documents\CKclPLKElHYqpwNQQTHEhxsQ.exe"
        5⤵
        
        PID:2384
    - - C:\Users\Admin\Documents\_EErSEyxd37NrVWRavTKjgn2.exe
        
        "C:\Users\Admin\Documents\_EErSEyxd37NrVWRavTKjgn2.exe"
        5⤵
        
        PID:2036
    - - C:\Users\Admin\Documents\RolfU0vHMwt7PXg7QRXELdTA.exe
        
        "C:\Users\Admin\Documents\RolfU0vHMwt7PXg7QRXELdTA.exe"
        5⤵
        
        PID:1312
    - - C:\Users\Admin\Documents\zKYJlpNSxeCZb9U4v0A8yooB.exe
        
        "C:\Users\Admin\Documents\zKYJlpNSxeCZb9U4v0A8yooB.exe"
        5⤵
        
        PID:2424
    - - C:\Users\Admin\Documents\o0k5R3_aHzydIRGkxi2O6p50.exe
        
        "C:\Users\Admin\Documents\o0k5R3_aHzydIRGkxi2O6p50.exe"
        5⤵
        
        PID:2464
    - - C:\Users\Admin\Documents\D_yOBMbDZIN6YNrqHkA21smK.exe
        
        "C:\Users\Admin\Documents\D_yOBMbDZIN6YNrqHkA21smK.exe"
        5⤵
        
        PID:2448
    - - C:\Users\Admin\Documents\SUfQ_paCyWuOfCDdQY_KPaL4.exe
        
        "C:\Users\Admin\Documents\SUfQ_paCyWuOfCDdQY_KPaL4.exe"
        5⤵
        
        PID:2504
    - - C:\Users\Admin\Documents\IUgxpXLJpfiFnW6rpH5JQ5vZ.exe
        
        "C:\Users\Admin\Documents\IUgxpXLJpfiFnW6rpH5JQ5vZ.exe"
        5⤵
        
        PID:944
    - - C:\Users\Admin\Documents\glHpOmGwKG9ZKzLwJRk0S70N.exe
        
        "C:\Users\Admin\Documents\glHpOmGwKG9ZKzLwJRk0S70N.exe"
        5⤵
        
        PID:2668
    - - C:\Users\Admin\Documents\7NKOHRvjNuCy3F1oOa6mss1F.exe
        
        "C:\Users\Admin\Documents\7NKOHRvjNuCy3F1oOa6mss1F.exe"
        5⤵
        
        PID:2656
    - - C:\Users\Admin\Documents\Sz3D9TL1aV1e1NPyJOaJ0uTN.exe
        
        "C:\Users\Admin\Documents\Sz3D9TL1aV1e1NPyJOaJ0uTN.exe"
        5⤵
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPRwKy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPRwKy.exe"
        6⤵
        
        PID:3120
    - - C:\Users\Admin\Documents\UM0G8xY_bYI5mWrQgnjMIME4.exe
        
        "C:\Users\Admin\Documents\UM0G8xY_bYI5mWrQgnjMIME4.exe"
        5⤵
        
        PID:1948
    - - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        "C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe"
        5⤵
        
        PID:1168
      - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        6⤵
        
        PID:3112
      - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        6⤵
        
        PID:1016
      - C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        
        C:\Users\Admin\Documents\HE78dkHCQFD9PdfR7z33xcjB.exe
        6⤵
        
        PID:3880
    - - C:\Users\Admin\Documents\DP_t0Shez2IzvsMi7E8tIQUY.exe
        
        "C:\Users\Admin\Documents\DP_t0Shez2IzvsMi7E8tIQUY.exe"
        5⤵
        
        PID:1712
    - - C:\Users\Admin\Documents\xZwYg0i0Q_VAzpscH1BLScpv.exe
        
        "C:\Users\Admin\Documents\xZwYg0i0Q_VAzpscH1BLScpv.exe"
        5⤵
        
        PID:1612
    - - C:\Users\Admin\Documents\V1hf6_9fRkdNV36zbHvXeQkp.exe
        
        "C:\Users\Admin\Documents\V1hf6_9fRkdNV36zbHvXeQkp.exe"
        5⤵
        
        PID:2376
    - - C:\Users\Admin\Documents\LVbcbPf2HmORAX5n5FVjgSFS.exe
        
        "C:\Users\Admin\Documents\LVbcbPf2HmORAX5n5FVjgSFS.exe"
        5⤵
        
        PID:1204
    - - C:\Users\Admin\Documents\2p_foztJuNmgtW6aO5K5DJBi.exe
        
        "C:\Users\Admin\Documents\2p_foztJuNmgtW6aO5K5DJBi.exe"
        5⤵
        
        PID:1968
    - - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        "C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe"
        5⤵
        
        PID:752
      - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        6⤵
        
        PID:3684
      - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        6⤵
        
        PID:764
      - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        6⤵
        
        PID:3616
      - C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        
        C:\Users\Admin\Documents\eSbb0EdnNa5l_aYRASJI2UcH.exe
        6⤵
        
        PID:3856
    - - C:\Users\Admin\Documents\fcPZvhqbyI_i4idXapBeg0HA.exe
        
        "C:\Users\Admin\Documents\fcPZvhqbyI_i4idXapBeg0HA.exe"
        5⤵
        
        PID:2640
    - - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        "C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe"
        5⤵
        
        PID:1756
      - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        6⤵
        
        PID:3276
      - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        6⤵
        
        PID:3492
      - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        6⤵
        
        PID:3884
      - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        6⤵
        
        PID:2284
      - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        6⤵
        
        PID:2128
      - C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        
        C:\Users\Admin\Documents\yNswBngdJVWEYa7rN3UA_nwW.exe
        6⤵
        
        PID:1068
    - - C:\Users\Admin\Documents\dkMg_KhTNK1yb4faF_I3PMdU.exe
        
        "C:\Users\Admin\Documents\dkMg_KhTNK1yb4faF_I3PMdU.exe"
        5⤵
        
        PID:1788
    - - C:\Users\Admin\Documents\bFbd2d4XtdqMEXNK1Nd31x6l.exe
        
        "C:\Users\Admin\Documents\bFbd2d4XtdqMEXNK1Nd31x6l.exe"
        5⤵
        
        PID:2816
      - C:\Users\Admin\Documents\bFbd2d4XtdqMEXNK1Nd31x6l.exe
        
        "C:\Users\Admin\Documents\bFbd2d4XtdqMEXNK1Nd31x6l.exe"
        6⤵
        
        PID:2696
    - - C:\Users\Admin\Documents\o1SwTAA6i78DONhgxQGENwPo.exe
        
        "C:\Users\Admin\Documents\o1SwTAA6i78DONhgxQGENwPo.exe"
        5⤵
        
        PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed06c0310f7c9.exe
    3⤵
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed06c0310f7c9.exe
      Wed06c0310f7c9.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Roaming\3876105.exe
        
        "C:\Users\Admin\AppData\Roaming\3876105.exe"
        5⤵
        
        PID:676
      - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        6⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Roaming\3981768.exe
        
        "C:\Users\Admin\AppData\Roaming\3981768.exe"
        5⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Roaming\1548569.exe
        
        "C:\Users\Admin\AppData\Roaming\1548569.exe"
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Roaming\8326554.exe
        
        "C:\Users\Admin\AppData\Roaming\8326554.exe"
        5⤵
        
        PID:2548
    - - C:\Users\Admin\AppData\Roaming\5433641.exe
        
        "C:\Users\Admin\AppData\Roaming\5433641.exe"
        5⤵
        
        PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed0677c055f84f3.exe
    3⤵
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed0677c055f84f3.exe
      Wed0677c055f84f3.exe
      4⤵
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        5⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
        6⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        6⤵
        
        PID:1980
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1980 -s 1392
        7⤵
        Program crash
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        6⤵
        
        PID:568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
        7⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
        6⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Roaming\2929850.exe
        
        "C:\Users\Admin\AppData\Roaming\2929850.exe"
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Roaming\3389749.exe
        
        "C:\Users\Admin\AppData\Roaming\3389749.exe"
        7⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe"
        6⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\3002.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
        7⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
        6⤵
        
        PID:2524

C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed069ea7b9fa22d66d.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8D586684\Wed069ea7b9fa22d66d.exe" -u
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-161-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/292-165-0x0000000000400000-0x0000000002167000-memory.dmp

Filesize
29.4MB

Download
memory/568-245-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/568-244-0x00000000003C0000-0x00000000003EF000-memory.dmp

Filesize
188KB

Download
memory/676-211-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/676-204-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/676-210-0x0000000000260000-0x000000000026C000-memory.dmp

Filesize
48KB

Download
memory/676-209-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/812-183-0x000000013FFD0000-0x000000013FFD1000-memory.dmp

Filesize
4KB

Download
memory/1056-250-0x0000000003F60000-0x000000000409F000-memory.dmp

Filesize
1.2MB

Download
memory/1224-169-0x0000000002AF0000-0x0000000002B05000-memory.dmp

Filesize
84KB

Download
memory/1372-176-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1376-207-0x000000001AFA0000-0x000000001AFA2000-memory.dmp

Filesize
8KB

Download
memory/1376-193-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1376-199-0x00000000003D0000-0x00000000003E8000-memory.dmp

Filesize
96KB

Download
memory/1456-168-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/1456-167-0x0000000004B32000-0x0000000004B33000-memory.dmp

Filesize
4KB

Download
memory/1456-230-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1456-164-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1456-166-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/1496-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/1516-205-0x000000001AFF0000-0x000000001AFF2000-memory.dmp

Filesize
8KB

Download
memory/1516-187-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1516-197-0x00000000005D0000-0x000000000061A000-memory.dmp

Filesize
296KB

Download
memory/1688-152-0x0000000001370000-0x0000000001371000-memory.dmp

Filesize
4KB

Download
memory/1688-162-0x00000000011B0000-0x00000000011B2000-memory.dmp

Filesize
8KB

Download
memory/1948-158-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/1948-160-0x00000000003C0000-0x00000000003D8000-memory.dmp

Filesize
96KB

Download
memory/1948-163-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1980-208-0x0000000000520000-0x0000000000522000-memory.dmp

Filesize
8KB

Download
memory/1980-200-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/1984-123-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1984-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1984-106-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1984-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1984-83-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1984-148-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1984-115-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1984-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1984-81-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1984-128-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2244-248-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/2244-220-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/2244-223-0x00000000009C0000-0x00000000009EE000-memory.dmp

Filesize
184KB

Download
memory/2292-224-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2452-238-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/2452-247-0x00000000052C0000-0x00000000052C1000-memory.dmp

Filesize
4KB

Download
memory/2524-239-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/2524-249-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/2548-253-0x0000000004960000-0x0000000004961000-memory.dmp

Filesize
4KB

Download
memory/2880-258-0x00000000022C0000-0x00000000022C1000-memory.dmp

Filesize
4KB

Download