raccoon | 843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0

Analysis

max time kernel
40s
max time network
133s
platform
windows7_x64
resource
win7-en-20210920
submitted
24-09-2021 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c1a477bf201d3cae1e15c81d164fb05.exe
Size

285KB
MD5

2c1a477bf201d3cae1e15c81d164fb05
SHA1

5dba8661b62ac6ef622e7e14678369c1dc94f586
SHA256

843140b0a3f095d74fe2682d3ae029d4da70a5bae79850cf047a72c9d4a882c0
SHA512

4460f5217e1557bf99f79dc08eeebcc42814f9deb186b61429fa084fe5b4b81e6279007fac5d7d776610eb2bfdfcdbfbdc0e39ff5e911fa07f494651d283cd9d

Score

10^/10

raccoon redline smokeloader tofsee xmrig 5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 700$qq russianhack backdoor evasion infostealer miner persistence stealer suricata themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

redline

Botnet

135.181.142.223:30397

Extracted

Family

redline

178.132.3.103:80

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes

url4cnc
https://t.me/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

700$

65.21.231.57:60751

Extracted

Family

redline

Botnet

russianhack

109.234.38.212:6677

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 14 IoCs

resource	yara_rule
behavioral1/memory/1104-82-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1104-83-0x000000000041C5CE-mapping.dmp	family_redline
behavioral1/memory/1104-85-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/files/0x000600000001263c-106.dat	family_redline
behavioral1/files/0x000600000001263c-107.dat	family_redline
behavioral1/memory/1648-129-0x00000000003E0000-0x00000000003FF000-memory.dmp	family_redline
behavioral1/memory/1648-130-0x0000000000840000-0x000000000085E000-memory.dmp	family_redline
behavioral1/memory/1412-146-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1412-151-0x000000000041C5CA-mapping.dmp	family_redline
behavioral1/memory/1412-154-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/1412-156-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2616-172-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/2616-173-0x000000000041933E-mapping.dmp	family_redline
behavioral1/memory/2616-175-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/2236-161-0x00000000000F0000-0x00000000001E1000-memory.dmp	xmrig
behavioral1/memory/2236-165-0x000000000018259C-mapping.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
840	BF1.exe
1696	EB0.exe
556	BF1.exe
1216	146C.exe
1820	1A17.exe
1104	EB0.exe
1156	207E.exe
1212	2BD5.exe
468	2F9D.exe
628	geommclb.exe
1648	3874.exe
1552	43AC.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	146C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	146C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	207E.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	207E.exe

Deletes itself 1 IoCs

pid	Process
1400	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
1696	EB0.exe
840	BF1.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x0006000000012604-74.dat	themida
behavioral1/memory/1216-77-0x0000000000130000-0x0000000000131000-memory.dmp	themida
behavioral1/files/0x0006000000012616-88.dat	themida
behavioral1/memory/1156-97-0x0000000001180000-0x0000000001181000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Windows\CurrentVersion\Run\intel.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2F9D.exe"	2F9D.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	146C.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	207E.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile:.repos	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1216	146C.exe
1156	207E.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1268 set thread context of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 840 set thread context of 556	840	BF1.exe	32
PID 1696 set thread context of 1104	1696	EB0.exe	31
PID 628 set thread context of 1664	628	geommclb.exe	54

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BF1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BF1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	BF1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c1a477bf201d3cae1e15c81d164fb05.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c1a477bf201d3cae1e15c81d164fb05.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c1a477bf201d3cae1e15c81d164fb05.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 1c395e3df710530424edb47d450dd49d084297dce82e72baa49817fdd47a771d9516082786cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56814db864a743ae4ae644490bdb1752dea905904c5f38d3c74bbc4103d29fca0691cd9814c7c35e49d084295d9e13f4bb4c06d02fdadfd5425d29d470d32f5a06f249ec60b1b79bdf0012dc089b6792deb915a03fda8e2377c88f2005469a8946c11dd824f733de3ad532d109d8d4de700633434fdc48d551de4ad035276a6cb2e569bb47d440dd49d642d0e29019351dda46d34fe089f571de4ad750c3dfeba6812c385497223e5a55c2df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad74da05cd94	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Buses	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
860	2c1a477bf201d3cae1e15c81d164fb05.exe
860	2c1a477bf201d3cae1e15c81d164fb05.exe
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
860	2c1a477bf201d3cae1e15c81d164fb05.exe
556	BF1.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeShutdownPrivilege	1400	Process not Found
Token: SeDebugPrivilege	1216	146C.exe
Token: SeDebugPrivilege	1104	EB0.exe
Token: SeDebugPrivilege	1156	207E.exe
Token: SeShutdownPrivilege	1400	Process not Found

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found
1400	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1268 wrote to memory of 860	1268	2c1a477bf201d3cae1e15c81d164fb05.exe	27
PID 1400 wrote to memory of 840	1400	Process not Found	28
PID 1400 wrote to memory of 840	1400	Process not Found	28
PID 1400 wrote to memory of 840	1400	Process not Found	28
PID 1400 wrote to memory of 840	1400	Process not Found	28
PID 1400 wrote to memory of 1696	1400	Process not Found	29
PID 1400 wrote to memory of 1696	1400	Process not Found	29
PID 1400 wrote to memory of 1696	1400	Process not Found	29
PID 1400 wrote to memory of 1696	1400	Process not Found	29
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 840 wrote to memory of 556	840	BF1.exe	32
PID 1400 wrote to memory of 1216	1400	Process not Found	33
PID 1400 wrote to memory of 1216	1400	Process not Found	33
PID 1400 wrote to memory of 1216	1400	Process not Found	33
PID 1400 wrote to memory of 1216	1400	Process not Found	33
PID 1400 wrote to memory of 1820	1400	Process not Found	35
PID 1400 wrote to memory of 1820	1400	Process not Found	35
PID 1400 wrote to memory of 1820	1400	Process not Found	35
PID 1400 wrote to memory of 1820	1400	Process not Found	35
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1696 wrote to memory of 1104	1696	EB0.exe	31
PID 1400 wrote to memory of 1156	1400	Process not Found	36
PID 1400 wrote to memory of 1156	1400	Process not Found	36
PID 1400 wrote to memory of 1156	1400	Process not Found	36
PID 1400 wrote to memory of 1156	1400	Process not Found	36
PID 1820 wrote to memory of 1496	1820	1A17.exe	38
PID 1820 wrote to memory of 1496	1820	1A17.exe	38
PID 1820 wrote to memory of 1496	1820	1A17.exe	38
PID 1820 wrote to memory of 1496	1820	1A17.exe	38
PID 1820 wrote to memory of 836	1820	1A17.exe	40
PID 1820 wrote to memory of 836	1820	1A17.exe	40
PID 1820 wrote to memory of 836	1820	1A17.exe	40
PID 1820 wrote to memory of 836	1820	1A17.exe	40
PID 1820 wrote to memory of 1056	1820	1A17.exe	42
PID 1820 wrote to memory of 1056	1820	1A17.exe	42
PID 1820 wrote to memory of 1056	1820	1A17.exe	42
PID 1820 wrote to memory of 1056	1820	1A17.exe	42
PID 1820 wrote to memory of 1088	1820	1A17.exe	44
PID 1820 wrote to memory of 1088	1820	1A17.exe	44
PID 1820 wrote to memory of 1088	1820	1A17.exe	44
PID 1820 wrote to memory of 1088	1820	1A17.exe	44
PID 1400 wrote to memory of 1212	1400	Process not Found	47
PID 1400 wrote to memory of 1212	1400	Process not Found	47
PID 1400 wrote to memory of 1212	1400	Process not Found	47
PID 1400 wrote to memory of 1212	1400	Process not Found	47
PID 1820 wrote to memory of 1720	1820	1A17.exe	48

C:\Users\Admin\AppData\Local\Temp\2c1a477bf201d3cae1e15c81d164fb05.exe
"C:\Users\Admin\AppData\Local\Temp\2c1a477bf201d3cae1e15c81d164fb05.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\2c1a477bf201d3cae1e15c81d164fb05.exe
  "C:\Users\Admin\AppData\Local\Temp\2c1a477bf201d3cae1e15c81d164fb05.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:860

C:\Users\Admin\AppData\Local\Temp\BF1.exe
C:\Users\Admin\AppData\Local\Temp\BF1.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Temp\BF1.exe
  C:\Users\Admin\AppData\Local\Temp\BF1.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:556

C:\Users\Admin\AppData\Local\Temp\EB0.exe
C:\Users\Admin\AppData\Local\Temp\EB0.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\EB0.exe
  C:\Users\Admin\AppData\Local\Temp\EB0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1104

C:\Users\Admin\AppData\Local\Temp\146C.exe
C:\Users\Admin\AppData\Local\Temp\146C.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Users\Admin\AppData\Local\Temp\1A17.exe
C:\Users\Admin\AppData\Local\Temp\1A17.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xolwagtw\
  2⤵
  PID:1496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\geommclb.exe" C:\Windows\SysWOW64\xolwagtw\
  2⤵
  PID:836
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create xolwagtw binPath= "C:\Windows\SysWOW64\xolwagtw\geommclb.exe /d\"C:\Users\Admin\AppData\Local\Temp\1A17.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:1056
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description xolwagtw "wifi internet conection"
  2⤵
  PID:1088
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start xolwagtw
  2⤵
  PID:1720
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:932

C:\Users\Admin\AppData\Local\Temp\207E.exe
C:\Users\Admin\AppData\Local\Temp\207E.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Users\Admin\AppData\Local\Temp\2BD5.exe
C:\Users\Admin\AppData\Local\Temp\2BD5.exe
1⤵
- Executes dropped EXE
PID:1212

C:\Users\Admin\AppData\Local\Temp\2F9D.exe
C:\Users\Admin\AppData\Local\Temp\2F9D.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:468

C:\Windows\SysWOW64\xolwagtw\geommclb.exe
C:\Windows\SysWOW64\xolwagtw\geommclb.exe /d"C:\Users\Admin\AppData\Local\Temp\1A17.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:628
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1664
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:2236

C:\Users\Admin\AppData\Local\Temp\3874.exe
C:\Users\Admin\AppData\Local\Temp\3874.exe
1⤵
- Executes dropped EXE
PID:1648

C:\Users\Admin\AppData\Local\Temp\43AC.exe
C:\Users\Admin\AppData\Local\Temp\43AC.exe
1⤵
- Executes dropped EXE
PID:1552

C:\Users\Admin\AppData\Local\Temp\4CF0.exe
C:\Users\Admin\AppData\Local\Temp\4CF0.exe
1⤵
PID:840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:1412

C:\Users\Admin\AppData\Local\Temp\5A2A.exe
C:\Users\Admin\AppData\Local\Temp\5A2A.exe
1⤵
PID:1460

C:\Users\Admin\AppData\Local\Temp\6958.exe
C:\Users\Admin\AppData\Local\Temp\6958.exe
1⤵
PID:1460
- C:\Users\Admin\AppData\Local\Temp\6958.exe
  "C:\Users\Admin\AppData\Local\Temp\6958.exe"
  2⤵
  PID:2616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-118-0x0000000000400000-0x0000000002B8F000-memory.dmp

Filesize
39.6MB

Download
memory/468-117-0x0000000000020000-0x000000000002D000-memory.dmp

Filesize
52KB

Download
memory/628-119-0x0000000000400000-0x0000000002B90000-memory.dmp

Filesize
39.6MB

Download
memory/840-139-0x0000000000FE0000-0x0000000001054000-memory.dmp

Filesize
464KB

Download
memory/840-140-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/840-143-0x0000000075F30000-0x0000000075F77000-memory.dmp

Filesize
284KB

Download
memory/860-55-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/860-53-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1104-82-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1104-91-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/1104-85-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1156-101-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/1156-97-0x0000000001180000-0x0000000001181000-memory.dmp

Filesize
4KB

Download
memory/1212-111-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/1212-108-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1216-79-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/1216-77-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1268-56-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/1400-57-0x0000000002AF0000-0x0000000002B06000-memory.dmp

Filesize
88KB

Download
memory/1400-102-0x00000000040A0000-0x00000000040B6000-memory.dmp

Filesize
88KB

Download
memory/1412-159-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1412-146-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1412-154-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1412-156-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1460-157-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/1460-170-0x00000000043B0000-0x00000000043D3000-memory.dmp

Filesize
140KB

Download
memory/1460-169-0x0000000005090000-0x00000000050DE000-memory.dmp

Filesize
312KB

Download
memory/1460-168-0x0000000000950000-0x0000000000998000-memory.dmp

Filesize
288KB

Download
memory/1460-167-0x0000000000360000-0x0000000000367000-memory.dmp

Filesize
28KB

Download
memory/1552-131-0x0000000000360000-0x00000000003F0000-memory.dmp

Filesize
576KB

Download
memory/1552-132-0x0000000000400000-0x0000000002BD0000-memory.dmp

Filesize
39.8MB

Download
memory/1648-129-0x00000000003E0000-0x00000000003FF000-memory.dmp

Filesize
124KB

Download
memory/1648-130-0x0000000000840000-0x000000000085E000-memory.dmp

Filesize
120KB

Download
memory/1648-135-0x0000000004771000-0x0000000004772000-memory.dmp

Filesize
4KB

Download
memory/1648-133-0x0000000000230000-0x0000000000260000-memory.dmp

Filesize
192KB

Download
memory/1648-134-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1664-120-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/1696-65-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1696-63-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1820-94-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/1820-93-0x0000000000400000-0x0000000002B90000-memory.dmp

Filesize
39.6MB

Download
memory/2236-161-0x00000000000F0000-0x00000000001E1000-memory.dmp

Filesize
964KB

Download
memory/2616-172-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2616-175-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download