raccoon | 39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b

Analysis

max time kernel
151s
max time network
99s
platform
windows10_x64
resource
win10v20210408
submitted
24-09-2021 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
Size

287KB
MD5

7db925ca083865c068baed7947c2b4a1
SHA1

d8e12bfbb94aa19360ee64198c55127fa3f961cb
SHA256

39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b
SHA512

7605409d310d462d85414145d25470140177434d20daaf7a2850c11fc58915ad6324f1f22a4a6f34d39e8bc192224f71dd1c68a52a795e7df2e5f1a56071005a

Score

10^/10

raccoon redline servhelper smokeloader xmrig 545 f6d7183c9e82d2a9b81e6c0608450aa66cefb51f backdoor discovery infostealer miner persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32

Extracted

Family

redline

Botnet

545

147.124.212.128:45499

Extracted

Family

raccoon

Botnet

f6d7183c9e82d2a9b81e6c0608450aa66cefb51f

Attributes

url4cnc
https://t.me/justoprostohello

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2192-150-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral1/memory/2192-151-0x000000000041C5DA-mapping.dmp	family_redline
behavioral1/memory/4000-764-0x000000000041933E-mapping.dmp	family_redline

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
2100	DDF7.exe
2472	E153.exe
2724	E51D.exe
3956	EA9C.exe
2192	E153.exe
3800	vk9oMUe37A.exe
4000	EA9C.exe
1160	sihost.exe
2304	rtsgwrt
3192	rtsgwrt

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
3024	Process not Found

Loads dropped DLL 6 IoCs

pid	Process
2724	E51D.exe
2724	E51D.exe
2724	E51D.exe
2724	E51D.exe
2724	E51D.exe
2724	E51D.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 2472 set thread context of 2192	2472	E153.exe	77
PID 3956 set thread context of 4000	3956	EA9C.exe	103
PID 2304 set thread context of 3192	2304	rtsgwrt	123

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3268	2472	WerFault.exe	72

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	rtsgwrt
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	rtsgwrt
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	rtsgwrt
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
424	schtasks.exe
1328	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3848	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Process not Found

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1192	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
888	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
888	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3024	Process not Found

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
612	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
888	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
3192	rtsgwrt

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	E153.exe
Token: SeRestorePrivilege	3268	WerFault.exe
Token: SeBackupPrivilege	3268	WerFault.exe
Token: SeDebugPrivilege	3268	WerFault.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	2192	E153.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	4000	EA9C.exe
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found
Token: SeShutdownPrivilege	3024	Process not Found
Token: SeCreatePagefilePrivilege	3024	Process not Found

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found
3024	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3024	Process not Found
3024	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 664 wrote to memory of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 664 wrote to memory of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 664 wrote to memory of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 664 wrote to memory of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 664 wrote to memory of 888	664	39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe	68
PID 3024 wrote to memory of 2100	3024	Process not Found	71
PID 3024 wrote to memory of 2100	3024	Process not Found	71
PID 3024 wrote to memory of 2100	3024	Process not Found	71
PID 3024 wrote to memory of 2472	3024	Process not Found	72
PID 3024 wrote to memory of 2472	3024	Process not Found	72
PID 3024 wrote to memory of 2472	3024	Process not Found	72
PID 3024 wrote to memory of 2724	3024	Process not Found	73
PID 3024 wrote to memory of 2724	3024	Process not Found	73
PID 3024 wrote to memory of 2724	3024	Process not Found	73
PID 3024 wrote to memory of 3956	3024	Process not Found	74
PID 3024 wrote to memory of 3956	3024	Process not Found	74
PID 3024 wrote to memory of 3956	3024	Process not Found	74
PID 2472 wrote to memory of 3936	2472	E153.exe	75
PID 2472 wrote to memory of 3936	2472	E153.exe	75
PID 2472 wrote to memory of 3936	2472	E153.exe	75
PID 2472 wrote to memory of 3008	2472	E153.exe	76
PID 2472 wrote to memory of 3008	2472	E153.exe	76
PID 2472 wrote to memory of 3008	2472	E153.exe	76
PID 2472 wrote to memory of 3236	2472	E153.exe	78
PID 2472 wrote to memory of 3236	2472	E153.exe	78
PID 2472 wrote to memory of 3236	2472	E153.exe	78
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2472 wrote to memory of 2192	2472	E153.exe	77
PID 2100 wrote to memory of 3528	2100	DDF7.exe	82
PID 2100 wrote to memory of 3528	2100	DDF7.exe	82
PID 2100 wrote to memory of 3528	2100	DDF7.exe	82
PID 3528 wrote to memory of 3868	3528	powershell.exe	86
PID 3528 wrote to memory of 3868	3528	powershell.exe	86
PID 3528 wrote to memory of 3868	3528	powershell.exe	86
PID 3868 wrote to memory of 3964	3868	csc.exe	87
PID 3868 wrote to memory of 3964	3868	csc.exe	87
PID 3868 wrote to memory of 3964	3868	csc.exe	87
PID 2724 wrote to memory of 3800	2724	E51D.exe	88
PID 2724 wrote to memory of 3800	2724	E51D.exe	88
PID 2724 wrote to memory of 3800	2724	E51D.exe	88
PID 2724 wrote to memory of 2900	2724	E51D.exe	89
PID 2724 wrote to memory of 2900	2724	E51D.exe	89
PID 2724 wrote to memory of 2900	2724	E51D.exe	89
PID 2900 wrote to memory of 3848	2900	cmd.exe	91
PID 2900 wrote to memory of 3848	2900	cmd.exe	91
PID 2900 wrote to memory of 3848	2900	cmd.exe	91
PID 3800 wrote to memory of 424	3800	vk9oMUe37A.exe	92
PID 3800 wrote to memory of 424	3800	vk9oMUe37A.exe	92
PID 3800 wrote to memory of 424	3800	vk9oMUe37A.exe	92
PID 3528 wrote to memory of 2696	3528	powershell.exe	94
PID 3528 wrote to memory of 2696	3528	powershell.exe	94
PID 3528 wrote to memory of 2696	3528	powershell.exe	94
PID 3528 wrote to memory of 2644	3528	powershell.exe	98
PID 3528 wrote to memory of 2644	3528	powershell.exe	98
PID 3528 wrote to memory of 2644	3528	powershell.exe	98
PID 3528 wrote to memory of 3192	3528	powershell.exe	101
PID 3528 wrote to memory of 3192	3528	powershell.exe	101

C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
"C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe
  "C:\Users\Admin\AppData\Local\Temp\39f4195b8a8516a361343c641b3343bbf870abc69f7f734105f29df6f630d37b.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:888

C:\Users\Admin\AppData\Local\Temp\DDF7.exe
C:\Users\Admin\AppData\Local\Temp\DDF7.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hmfwopc3\hmfwopc3.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2C36.tmp" "c:\Users\Admin\AppData\Local\Temp\hmfwopc3\CSCE6982F71AF524AC3A2F8C15B4174F258.TMP"
      4⤵
      PID:3964
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:892
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:1192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    PID:4000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    PID:1960
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      PID:3788
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        
        PID:964
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:412
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:3112
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        
        PID:3380
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:4016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:412
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1792

C:\Users\Admin\AppData\Local\Temp\E153.exe
C:\Users\Admin\AppData\Local\Temp\E153.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\E153.exe
  "C:\Users\Admin\AppData\Local\Temp\E153.exe"
  2⤵
  PID:3936
- C:\Users\Admin\AppData\Local\Temp\E153.exe
  "C:\Users\Admin\AppData\Local\Temp\E153.exe"
  2⤵
  PID:3008
- C:\Users\Admin\AppData\Local\Temp\E153.exe
  "C:\Users\Admin\AppData\Local\Temp\E153.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\E153.exe
  "C:\Users\Admin\AppData\Local\Temp\E153.exe"
  2⤵
  PID:3236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2472 -s 948
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3268

C:\Users\Admin\AppData\Local\Temp\E51D.exe
C:\Users\Admin\AppData\Local\Temp\E51D.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe
  "C:\Users\Admin\AppData\Local\Temp\vk9oMUe37A.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
    3⤵
    - Creates scheduled task(s)
    PID:424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E51D.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 10 /NOBREAK
    3⤵
    - Delays execution with timeout.exe
    PID:3848

C:\Users\Admin\AppData\Local\Temp\EA9C.exe
C:\Users\Admin\AppData\Local\Temp\EA9C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3956
- C:\Users\Admin\AppData\Local\Temp\EA9C.exe
  "C:\Users\Admin\AppData\Local\Temp\EA9C.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4000

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe
1⤵
- Executes dropped EXE
PID:1160
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sihost.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1328

C:\Users\Admin\AppData\Roaming\rtsgwrt
C:\Users\Admin\AppData\Roaming\rtsgwrt
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2304
- C:\Users\Admin\AppData\Roaming\rtsgwrt
  C:\Users\Admin\AppData\Roaming\rtsgwrt
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-114-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/888-115-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1160-1107-0x0000000000400000-0x0000000002B90000-memory.dmp

Filesize
39.6MB

Download
memory/2100-135-0x00000000036A0000-0x0000000003AA2000-memory.dmp

Filesize
4.0MB

Download
memory/2100-139-0x0000000008050000-0x000000000844F000-memory.dmp

Filesize
4.0MB

Download
memory/2100-137-0x0000000000400000-0x0000000002F86000-memory.dmp

Filesize
43.5MB

Download
memory/2100-144-0x0000000007C32000-0x0000000007C33000-memory.dmp

Filesize
4KB

Download
memory/2100-165-0x000000000A010000-0x000000000A011000-memory.dmp

Filesize
4KB

Download
memory/2100-149-0x0000000007C30000-0x0000000007C31000-memory.dmp

Filesize
4KB

Download
memory/2100-147-0x0000000007C33000-0x0000000007C34000-memory.dmp

Filesize
4KB

Download
memory/2100-162-0x0000000007C34000-0x0000000007C35000-memory.dmp

Filesize
4KB

Download
memory/2192-194-0x0000000007220000-0x0000000007221000-memory.dmp

Filesize
4KB

Download
memory/2192-150-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2192-156-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/2192-159-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/2192-160-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/2192-166-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/2192-193-0x0000000006B20000-0x0000000006B21000-memory.dmp

Filesize
4KB

Download
memory/2192-168-0x0000000005170000-0x0000000005776000-memory.dmp

Filesize
6.0MB

Download
memory/2192-170-0x0000000005290000-0x0000000005291000-memory.dmp

Filesize
4KB

Download
memory/2192-202-0x0000000006F80000-0x0000000006F81000-memory.dmp

Filesize
4KB

Download
memory/2192-205-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

Filesize
4KB

Download
memory/2472-130-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/2472-153-0x0000000005960000-0x0000000005963000-memory.dmp

Filesize
12KB

Download
memory/2472-143-0x00000000057E0000-0x0000000005CDE000-memory.dmp

Filesize
5.0MB

Download
memory/2472-124-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2472-126-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Filesize
4KB

Download
memory/2472-138-0x0000000005920000-0x0000000005938000-memory.dmp

Filesize
96KB

Download
memory/2472-129-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/2644-506-0x0000000004F22000-0x0000000004F23000-memory.dmp

Filesize
4KB

Download
memory/2644-536-0x000000007F1F0000-0x000000007F1F1000-memory.dmp

Filesize
4KB

Download
memory/2644-505-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/2696-254-0x0000000004572000-0x0000000004573000-memory.dmp

Filesize
4KB

Download
memory/2696-253-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/2696-265-0x0000000008400000-0x0000000008433000-memory.dmp

Filesize
204KB

Download
memory/2696-280-0x000000007F110000-0x000000007F111000-memory.dmp

Filesize
4KB

Download
memory/2724-161-0x0000000000400000-0x0000000002BD0000-memory.dmp

Filesize
39.8MB

Download
memory/2724-141-0x0000000002E60000-0x0000000002EF0000-memory.dmp

Filesize
576KB

Download
memory/3024-117-0x00000000005D0000-0x00000000005E6000-memory.dmp

Filesize
88KB

Download
memory/3024-1233-0x0000000000770000-0x0000000000786000-memory.dmp

Filesize
88KB

Download
memory/3192-857-0x000000007F170000-0x000000007F171000-memory.dmp

Filesize
4KB

Download
memory/3192-781-0x0000000006A92000-0x0000000006A93000-memory.dmp

Filesize
4KB

Download
memory/3192-779-0x0000000006A90000-0x0000000006A91000-memory.dmp

Filesize
4KB

Download
memory/3528-175-0x0000000006C10000-0x0000000006C11000-memory.dmp

Filesize
4KB

Download
memory/3528-186-0x0000000007660000-0x0000000007661000-memory.dmp

Filesize
4KB

Download
memory/3528-174-0x00000000065A0000-0x00000000065A1000-memory.dmp

Filesize
4KB

Download
memory/3528-1232-0x000000007E5B0000-0x000000007E5B1000-memory.dmp

Filesize
4KB

Download
memory/3528-241-0x0000000008B40000-0x0000000008B41000-memory.dmp

Filesize
4KB

Download
memory/3528-189-0x0000000007D90000-0x0000000007D91000-memory.dmp

Filesize
4KB

Download
memory/3528-203-0x0000000008A50000-0x0000000008A51000-memory.dmp

Filesize
4KB

Download
memory/3528-187-0x0000000007480000-0x0000000007481000-memory.dmp

Filesize
4KB

Download
memory/3528-201-0x0000000009430000-0x0000000009431000-memory.dmp

Filesize
4KB

Download
memory/3528-212-0x00000000068A0000-0x00000000068A1000-memory.dmp

Filesize
4KB

Download
memory/3528-184-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/3528-183-0x00000000072B0000-0x00000000072B1000-memory.dmp

Filesize
4KB

Download
memory/3528-176-0x0000000006590000-0x0000000006591000-memory.dmp

Filesize
4KB

Download
memory/3528-218-0x0000000006593000-0x0000000006594000-memory.dmp

Filesize
4KB

Download
memory/3528-177-0x0000000006592000-0x0000000006593000-memory.dmp

Filesize
4KB

Download
memory/3800-243-0x0000000000030000-0x0000000000034000-memory.dmp

Filesize
16KB

Download
memory/3800-244-0x0000000000400000-0x0000000002B90000-memory.dmp

Filesize
39.6MB

Download
memory/3956-157-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/3956-134-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/3956-167-0x00000000051C0000-0x00000000051C7000-memory.dmp

Filesize
28KB

Download
memory/3956-163-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/4000-782-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download