raccoon | 85a36b790bf6afe574fe90bc06e56c1a5b0380d987026d2cd7c75f795a8de73c

Analysis

max time kernel
152s
max time network
159s
platform
windows10_x64
resource
win10-en-20210920
submitted
15/10/2021, 07:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4adf9c89320348237cc3921c19eb2cc7.exe
Size 310KB
Sample211015-jlfqwabddm
SHA256 85a36b790bf6afe574fe90bc06e56c1a5b0380d987026d2cd7c75f795a8de73c
MD5 4adf9c89320348237cc3921c19eb2cc7
SHA1 90d66f6c09d3c7d5b8ddfcba3692869e25d55f29
SHA512 9b6423db973f2c05b9bc5a3c9b2bf37e1b9f2b60fb4e497b255054084d7b5eb8c906ae0c0c4d4d347ad5a94de3acf9a037ba739f4bf01049dab94f23c629ffd6
MD5 SHA1 SHA512

Score

10^/10

raccoon redline smokeloader tofsee 12 fbe5e97e7d069407605ee9138022aa82166657e6 megaproliv2 backdoor discovery evasion infostealer persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://honawey7.top/
http://wijibui0.top/
http://hefahei6.top/
http://pipevai4.top/
http://nalirou7.top/

rc4.i32

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Extracted

Family

redline

Botnet

135.181.208.162:13904

Extracted

Family

redline

Botnet

MegaProliv2

93.115.20.139:28978

Extracted

Family

raccoon

Version

1.8.2

Botnet

fbe5e97e7d069407605ee9138022aa82166657e6

Attributes

url4cnc
http://telemirror.top/stevuitreen

http://tgmirror.top/stevuitreen

http://telegatt.top/stevuitreen

http://telegka.top/stevuitreen

http://telegin.top/stevuitreen

https://t.me/stevuitreen

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral2/memory/2940-159-0x0000000000438F0E-mapping.dmp	family_redline
behavioral2/memory/2940-157-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/784-207-0x0000000000690000-0x00000000006C1000-memory.dmp	family_redline
behavioral2/memory/784-212-0x0000000000800000-0x000000000081B000-memory.dmp	family_redline
behavioral2/memory/2008-225-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/2008-226-0x000000000041B252-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/files/0x000400000001abbf-141.dat	Nirsoft
behavioral2/files/0x000400000001abbf-142.dat	Nirsoft
behavioral2/files/0x000400000001abbf-144.dat	Nirsoft

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
3388	41F7.exe
1716	41F7.exe
3408	4CC5.exe
1788	4FB4.exe
1768	AdvancedRun.exe
1004	AdvancedRun.exe
1380	bcaknglw.exe
2940	4FB4.exe
3948	686D.exe
3260	6ED7.exe
784	79D4.exe
2008	6ED7.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
2648	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4FB4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	4FB4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	4FB4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4FB4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	4FB4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	4FB4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\4FB4.exe = "0"	4FB4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	4FB4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	4FB4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4FB4.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe
1788	4FB4.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 3388 set thread context of 1716	3388	41F7.exe	71
PID 1788 set thread context of 2940	1788	4FB4.exe	94
PID 1380 set thread context of 1896	1380	bcaknglw.exe	104
PID 3260 set thread context of 2008	3260	6ED7.exe	103

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3752	1788	WerFault.exe	75

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	41F7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4adf9c89320348237cc3921c19eb2cc7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4adf9c89320348237cc3921c19eb2cc7.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4adf9c89320348237cc3921c19eb2cc7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	41F7.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	41F7.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3612	4adf9c89320348237cc3921c19eb2cc7.exe
3612	4adf9c89320348237cc3921c19eb2cc7.exe
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found
2648	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3612	4adf9c89320348237cc3921c19eb2cc7.exe
1716	41F7.exe

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeDebugPrivilege	1788	4FB4.exe
Token: SeDebugPrivilege	1768	AdvancedRun.exe
Token: SeImpersonatePrivilege	1768	AdvancedRun.exe
Token: SeDebugPrivilege	1004	AdvancedRun.exe
Token: SeImpersonatePrivilege	1004	AdvancedRun.exe
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeRestorePrivilege	3752	WerFault.exe
Token: SeBackupPrivilege	3752	WerFault.exe
Token: SeBackupPrivilege	3752	WerFault.exe
Token: SeDebugPrivilege	3752	WerFault.exe
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeDebugPrivilege	2940	4FB4.exe
Token: SeDebugPrivilege	784	79D4.exe
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeDebugPrivilege	2008	6ED7.exe
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found
Token: SeShutdownPrivilege	2648	Process not Found
Token: SeCreatePagefilePrivilege	2648	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 2132 wrote to memory of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 2132 wrote to memory of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 2132 wrote to memory of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 2132 wrote to memory of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 2132 wrote to memory of 3612	2132	4adf9c89320348237cc3921c19eb2cc7.exe	69
PID 2648 wrote to memory of 3388	2648	Process not Found	70
PID 2648 wrote to memory of 3388	2648	Process not Found	70
PID 2648 wrote to memory of 3388	2648	Process not Found	70
PID 3388 wrote to memory of 1716	3388	41F7.exe	71
PID 3388 wrote to memory of 1716	3388	41F7.exe	71
PID 3388 wrote to memory of 1716	3388	41F7.exe	71
PID 3388 wrote to memory of 1716	3388	41F7.exe	71
PID 3388 wrote to memory of 1716	3388	41F7.exe	71
PID 3388 wrote to memory of 1716	3388	41F7.exe	71
PID 2648 wrote to memory of 3408	2648	Process not Found	73
PID 2648 wrote to memory of 3408	2648	Process not Found	73
PID 2648 wrote to memory of 3408	2648	Process not Found	73
PID 2648 wrote to memory of 1788	2648	Process not Found	75
PID 2648 wrote to memory of 1788	2648	Process not Found	75
PID 2648 wrote to memory of 1788	2648	Process not Found	75
PID 1788 wrote to memory of 1768	1788	4FB4.exe	77
PID 1788 wrote to memory of 1768	1788	4FB4.exe	77
PID 1788 wrote to memory of 1768	1788	4FB4.exe	77
PID 1768 wrote to memory of 1004	1768	AdvancedRun.exe	78
PID 1768 wrote to memory of 1004	1768	AdvancedRun.exe	78
PID 1768 wrote to memory of 1004	1768	AdvancedRun.exe	78
PID 3408 wrote to memory of 2388	3408	4CC5.exe	80
PID 3408 wrote to memory of 2388	3408	4CC5.exe	80
PID 3408 wrote to memory of 2388	3408	4CC5.exe	80
PID 3408 wrote to memory of 1488	3408	4CC5.exe	83
PID 3408 wrote to memory of 1488	3408	4CC5.exe	83
PID 3408 wrote to memory of 1488	3408	4CC5.exe	83
PID 3408 wrote to memory of 4092	3408	4CC5.exe	85
PID 3408 wrote to memory of 4092	3408	4CC5.exe	85
PID 3408 wrote to memory of 4092	3408	4CC5.exe	85
PID 3408 wrote to memory of 3048	3408	4CC5.exe	87
PID 3408 wrote to memory of 3048	3408	4CC5.exe	87
PID 3408 wrote to memory of 3048	3408	4CC5.exe	87
PID 3408 wrote to memory of 1880	3408	4CC5.exe	89
PID 3408 wrote to memory of 1880	3408	4CC5.exe	89
PID 3408 wrote to memory of 1880	3408	4CC5.exe	89
PID 1788 wrote to memory of 1948	1788	4FB4.exe	92
PID 1788 wrote to memory of 1948	1788	4FB4.exe	92
PID 1788 wrote to memory of 1948	1788	4FB4.exe	92
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 1788 wrote to memory of 2940	1788	4FB4.exe	94
PID 3408 wrote to memory of 3680	3408	4CC5.exe	95
PID 3408 wrote to memory of 3680	3408	4CC5.exe	95
PID 3408 wrote to memory of 3680	3408	4CC5.exe	95
PID 2648 wrote to memory of 3948	2648	Process not Found	100
PID 2648 wrote to memory of 3948	2648	Process not Found	100
PID 2648 wrote to memory of 3948	2648	Process not Found	100
PID 2648 wrote to memory of 3260	2648	Process not Found	101
PID 2648 wrote to memory of 3260	2648	Process not Found	101
PID 2648 wrote to memory of 3260	2648	Process not Found	101
PID 3260 wrote to memory of 2008	3260	6ED7.exe	103
PID 3260 wrote to memory of 2008	3260	6ED7.exe	103

C:\Users\Admin\AppData\Local\Temp\4adf9c89320348237cc3921c19eb2cc7.exe
"C:\Users\Admin\AppData\Local\Temp\4adf9c89320348237cc3921c19eb2cc7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\4adf9c89320348237cc3921c19eb2cc7.exe
  "C:\Users\Admin\AppData\Local\Temp\4adf9c89320348237cc3921c19eb2cc7.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3612

C:\Users\Admin\AppData\Local\Temp\41F7.exe
C:\Users\Admin\AppData\Local\Temp\41F7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\41F7.exe
  C:\Users\Admin\AppData\Local\Temp\41F7.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:1716

C:\Users\Admin\AppData\Local\Temp\4CC5.exe
C:\Users\Admin\AppData\Local\Temp\4CC5.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fukqpyne\
  2⤵
  PID:2388
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bcaknglw.exe" C:\Windows\SysWOW64\fukqpyne\
  2⤵
  PID:1488
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create fukqpyne binPath= "C:\Windows\SysWOW64\fukqpyne\bcaknglw.exe /d\"C:\Users\Admin\AppData\Local\Temp\4CC5.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:4092
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description fukqpyne "wifi internet conection"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start fukqpyne
  2⤵
  PID:1880
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:3680

C:\Users\Admin\AppData\Local\Temp\4FB4.exe
C:\Users\Admin\AppData\Local\Temp\4FB4.exe
1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\258804fc-a03c-459f-a22d-389fc3ca55e6\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\258804fc-a03c-459f-a22d-389fc3ca55e6\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\258804fc-a03c-459f-a22d-389fc3ca55e6\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\258804fc-a03c-459f-a22d-389fc3ca55e6\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\258804fc-a03c-459f-a22d-389fc3ca55e6\AdvancedRun.exe" /SpecialRun 4101d8 1768
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4FB4.exe" -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\4FB4.exe
  "C:\Users\Admin\AppData\Local\Temp\4FB4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 2256
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3752

C:\Windows\SysWOW64\fukqpyne\bcaknglw.exe
C:\Windows\SysWOW64\fukqpyne\bcaknglw.exe /d"C:\Users\Admin\AppData\Local\Temp\4CC5.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1380
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1896

C:\Users\Admin\AppData\Local\Temp\686D.exe
C:\Users\Admin\AppData\Local\Temp\686D.exe
1⤵
- Executes dropped EXE
PID:3948

C:\Users\Admin\AppData\Local\Temp\6ED7.exe
C:\Users\Admin\AppData\Local\Temp\6ED7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Users\Admin\AppData\Local\Temp\6ED7.exe
  C:\Users\Admin\AppData\Local\Temp\6ED7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2008

C:\Users\Admin\AppData\Local\Temp\79D4.exe
C:\Users\Admin\AppData\Local\Temp\79D4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

New Service

T1050

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-207-0x0000000000690000-0x00000000006C1000-memory.dmp

Download

memory/784-222-0x0000000005043000-0x0000000005044000-memory.dmp

Download

memory/784-220-0x0000000005042000-0x0000000005043000-memory.dmp

Download

memory/784-219-0x0000000005044000-0x0000000005045000-memory.dmp

Download

memory/784-212-0x0000000000800000-0x000000000081B000-memory.dmp

Download

memory/784-217-0x0000000005040000-0x0000000005041000-memory.dmp

Download

memory/1380-201-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/1380-195-0x0000000001820000-0x0000000001833000-memory.dmp

Download

memory/1788-134-0x0000000000350000-0x0000000000351000-memory.dmp

Download

memory/1788-137-0x00000000025D0000-0x000000000266E000-memory.dmp

Download

memory/1788-136-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1788-139-0x00000000079F0000-0x00000000079F1000-memory.dmp

Download

memory/1788-138-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

Download

memory/1896-196-0x0000000000DC0000-0x0000000000DD5000-memory.dmp

Download

memory/1896-198-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1896-200-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1948-256-0x0000000004D63000-0x0000000004D64000-memory.dmp

Download

memory/1948-191-0x00000000083A0000-0x00000000083A1000-memory.dmp

Download

memory/1948-169-0x0000000004D62000-0x0000000004D63000-memory.dmp

Download

memory/1948-248-0x000000007ECC0000-0x000000007ECC1000-memory.dmp

Download

memory/1948-172-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Download

memory/1948-237-0x00000000097F0000-0x0000000009823000-memory.dmp

Download

memory/1948-202-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1948-167-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/1948-164-0x0000000007790000-0x0000000007791000-memory.dmp

Download

memory/1948-162-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1948-163-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/1948-181-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Download

memory/1948-160-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/1948-180-0x0000000007E60000-0x0000000007E61000-memory.dmp

Download

memory/1948-183-0x0000000008050000-0x0000000008051000-memory.dmp

Download

memory/2008-250-0x0000000004E00000-0x0000000005406000-memory.dmp

Download

memory/2008-225-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2132-118-0x00000000017E0000-0x00000000017E9000-memory.dmp

Download

memory/2648-151-0x0000000002EF0000-0x0000000002F06000-memory.dmp

Download

memory/2648-119-0x0000000000B90000-0x0000000000BA6000-memory.dmp

Download

memory/2940-179-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/2940-178-0x0000000005220000-0x0000000005221000-memory.dmp

Download

memory/2940-168-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/2940-170-0x0000000005100000-0x0000000005101000-memory.dmp

Download

memory/2940-171-0x0000000005720000-0x0000000005721000-memory.dmp

Download

memory/2940-176-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/2940-157-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2940-182-0x00000000051A0000-0x00000000051A1000-memory.dmp

Download

memory/3260-187-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/3260-190-0x00000000022C0000-0x00000000022C1000-memory.dmp

Download

memory/3260-189-0x0000000004850000-0x0000000004851000-memory.dmp

Download

memory/3260-193-0x0000000002260000-0x00000000022D6000-memory.dmp

Download

memory/3388-123-0x0000000001766000-0x0000000001777000-memory.dmp

Download

memory/3408-148-0x0000000001800000-0x000000000194A000-memory.dmp

Download

memory/3408-149-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/3612-116-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3948-244-0x0000000002110000-0x000000000219E000-memory.dmp

Download

memory/3948-246-0x0000000000400000-0x00000000004F8000-memory.dmp

Download