redline | c6498d4425f32bb7027530a8f717b3374a2fc968f5f6f804ce17626644e17133

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-en-20210920
submitted
27-10-2021 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b1e1484298d966a4327e86c0a31a8e4.exe
Size

334KB
MD5

8b1e1484298d966a4327e86c0a31a8e4
SHA1

dfcedcd2eda71d47f32f65ce8dfe3c76c290b56f
SHA256

c6498d4425f32bb7027530a8f717b3374a2fc968f5f6f804ce17626644e17133
SHA512

e2b8c0b10081e773415b0721305a5149e2bbfe4fe0b052e835a16047cdabe069fedba35adb63bb21bf0b08ae0b6d15276d19358ec14c7d170d6709420117b4e3

Score

10^/10

redline smokeloader vidar 11111 754 backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://xacokuo8.top/

http://hajezey1.top/

http://gejajoo7.top/

http://sysaheu9.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/

rc4.i32

Extracted

Family

redline

Botnet

11111

93.115.20.139:28978

Extracted

Family

vidar

Version

41.6

Botnet

754

https://mas.to/@lilocc

Attributes

profile_id
754

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1648-88-0x0000000001E90000-0x0000000001EAA000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/984-93-0x0000000004890000-0x0000000004966000-memory.dmp	family_vidar
behavioral1/memory/984-94-0x0000000000400000-0x0000000002F6F000-memory.dmp	family_vidar

Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

8AB3.exe9204.exe9417.exe8AB3.exe9C42.exeBD24.exebbfdwvtbbfdwvt

pid process

1740 8AB3.exe
1648 9204.exe
1516 9417.exe
1460 8AB3.exe
984 9C42.exe
1472 BD24.exe
1996 bbfdwvt
1676 bbfdwvt
Deletes itself 1 IoCs

Processes:

pid process

1400
Loads dropped DLL 9 IoCs

Processes:

8AB3.exe9417.exeWerFault.exe

pid process

1740 8AB3.exe
1516 9417.exe
1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
1696 WerFault.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1740	8AB3.exe
1648	9204.exe
1516	9417.exe
1460	8AB3.exe
984	9C42.exe
1472	BD24.exe
1996	bbfdwvt
1676	bbfdwvt

pid	process
1400

pid	process
1740	8AB3.exe
1516	9417.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe
1696	WerFault.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

8b1e1484298d966a4327e86c0a31a8e4.exe8AB3.exebbfdwvt

description	pid	process	target process
PID 1612 set thread context of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1740 set thread context of 1460	1740	8AB3.exe	8AB3.exe
PID 1996 set thread context of 1676	1996	bbfdwvt	bbfdwvt

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1696 984 WerFault.exe 9C42.exe

pid	pid_target	process	target process
1696	984	WerFault.exe	9C42.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8AB3.exe9417.exe8b1e1484298d966a4327e86c0a31a8e4.exebbfdwvt

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8AB3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8AB3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8b1e1484298d966a4327e86c0a31a8e4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8b1e1484298d966a4327e86c0a31a8e4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8b1e1484298d966a4327e86c0a31a8e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbfdwvt
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbfdwvt
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bbfdwvt
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	8AB3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9417.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	9417.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

9204.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	9204.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	9204.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	9204.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8b1e1484298d966a4327e86c0a31a8e4.exe

pid	process
588	8b1e1484298d966a4327e86c0a31a8e4.exe
588	8b1e1484298d966a4327e86c0a31a8e4.exe
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400
1400

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1400
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

8b1e1484298d966a4327e86c0a31a8e4.exe8AB3.exe9417.exe

pid process

588 8b1e1484298d966a4327e86c0a31a8e4.exe
1460 8AB3.exe
1516 9417.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

9204.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1648 9204.exe
Token: SeDebugPrivilege 1696 WerFault.exe
Token: SeShutdownPrivilege 1400
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

pid process

1400
1400
1400
1400
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

1400
1400

pid	process
1400

description	pid	process
Token: SeDebugPrivilege	1648	9204.exe
Token: SeDebugPrivilege	1696	WerFault.exe
Token: SeShutdownPrivilege	1400

pid	process
1400
1400
1400
1400

pid	process
1400
1400

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

8b1e1484298d966a4327e86c0a31a8e4.exe8AB3.exe9C42.exetaskeng.exebbfdwvt

description	pid	process	target process
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1612 wrote to memory of 588	1612	8b1e1484298d966a4327e86c0a31a8e4.exe	8b1e1484298d966a4327e86c0a31a8e4.exe
PID 1400 wrote to memory of 1740	1400		8AB3.exe
PID 1400 wrote to memory of 1740	1400		8AB3.exe
PID 1400 wrote to memory of 1740	1400		8AB3.exe
PID 1400 wrote to memory of 1740	1400		8AB3.exe
PID 1400 wrote to memory of 1648	1400		9204.exe
PID 1400 wrote to memory of 1648	1400		9204.exe
PID 1400 wrote to memory of 1648	1400		9204.exe
PID 1400 wrote to memory of 1648	1400		9204.exe
PID 1400 wrote to memory of 1516	1400		9417.exe
PID 1400 wrote to memory of 1516	1400		9417.exe
PID 1400 wrote to memory of 1516	1400		9417.exe
PID 1400 wrote to memory of 1516	1400		9417.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1740 wrote to memory of 1460	1740	8AB3.exe	8AB3.exe
PID 1400 wrote to memory of 984	1400		9C42.exe
PID 1400 wrote to memory of 984	1400		9C42.exe
PID 1400 wrote to memory of 984	1400		9C42.exe
PID 1400 wrote to memory of 984	1400		9C42.exe
PID 1400 wrote to memory of 1472	1400		BD24.exe
PID 1400 wrote to memory of 1472	1400		BD24.exe
PID 1400 wrote to memory of 1472	1400		BD24.exe
PID 1400 wrote to memory of 1472	1400		BD24.exe
PID 984 wrote to memory of 1696	984	9C42.exe	WerFault.exe
PID 984 wrote to memory of 1696	984	9C42.exe	WerFault.exe
PID 984 wrote to memory of 1696	984	9C42.exe	WerFault.exe
PID 984 wrote to memory of 1696	984	9C42.exe	WerFault.exe
PID 1688 wrote to memory of 1996	1688	taskeng.exe	bbfdwvt
PID 1688 wrote to memory of 1996	1688	taskeng.exe	bbfdwvt
PID 1688 wrote to memory of 1996	1688	taskeng.exe	bbfdwvt
PID 1688 wrote to memory of 1996	1688	taskeng.exe	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt
PID 1996 wrote to memory of 1676	1996	bbfdwvt	bbfdwvt

C:\Users\Admin\AppData\Local\Temp\8b1e1484298d966a4327e86c0a31a8e4.exe
"C:\Users\Admin\AppData\Local\Temp\8b1e1484298d966a4327e86c0a31a8e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\8b1e1484298d966a4327e86c0a31a8e4.exe
"C:\Users\Admin\AppData\Local\Temp\8b1e1484298d966a4327e86c0a31a8e4.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:588

C:\Users\Admin\AppData\Local\Temp\8AB3.exe
C:\Users\Admin\AppData\Local\Temp\8AB3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740

C:\Users\Admin\AppData\Local\Temp\8AB3.exe
C:\Users\Admin\AppData\Local\Temp\8AB3.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1460

C:\Users\Admin\AppData\Local\Temp\9204.exe
C:\Users\Admin\AppData\Local\Temp\9204.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:1648

C:\Users\Admin\AppData\Local\Temp\9417.exe
C:\Users\Admin\AppData\Local\Temp\9417.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1516

C:\Users\Admin\AppData\Local\Temp\9C42.exe
C:\Users\Admin\AppData\Local\Temp\9C42.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 868
2⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Users\Admin\AppData\Local\Temp\BD24.exe
C:\Users\Admin\AppData\Local\Temp\BD24.exe
1⤵
- Executes dropped EXE
PID:1472

C:\Windows\system32\taskeng.exe
taskeng.exe {32CF8255-BF3E-4A3E-AA8A-26F38121A39D} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Roaming\bbfdwvt
C:\Users\Admin\AppData\Roaming\bbfdwvt
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1996

C:\Users\Admin\AppData\Roaming\bbfdwvt
C:\Users\Admin\AppData\Roaming\bbfdwvt
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
fb8cbfe65ab3de0b5a0dad974f495f09

SHA1
e612fbcd9d90aa98f33cce270c24047a276dc3f8

SHA256
74d4934483befd6e4fc75baefc1e0ebc4b78528f3f46bf6b7e4c1b981446bd74

SHA512
d20e7e2e41e4bc82c709a9587f2603a3afbc0c39421b622516a6b33f4ceb7e09b3a4ae57c266eb0bb26bd152706d7c5dc320e826b1298426c81c01a054d6536c

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AB3.exe
MD5
6082870c958221e33434c3819da0d6b0

SHA1
8ab81bd6a238b4e088e93bea97c3394b5a762749

SHA256
305ebe159194fb04b8277b88250e2c184637d3130b1afa1d48fa6917c4f965ff

SHA512
b04bc6199a05ab9acd434508a92a54028f2430de7ff1d2997a24d869da6227af32ca19fcaf66f251c785e2f6685bd4adf3c6c3e295ed02f577a74a2a5fbeaac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AB3.exe
MD5
6082870c958221e33434c3819da0d6b0

SHA1
8ab81bd6a238b4e088e93bea97c3394b5a762749

SHA256
305ebe159194fb04b8277b88250e2c184637d3130b1afa1d48fa6917c4f965ff

SHA512
b04bc6199a05ab9acd434508a92a54028f2430de7ff1d2997a24d869da6227af32ca19fcaf66f251c785e2f6685bd4adf3c6c3e295ed02f577a74a2a5fbeaac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AB3.exe
MD5
6082870c958221e33434c3819da0d6b0

SHA1
8ab81bd6a238b4e088e93bea97c3394b5a762749

SHA256
305ebe159194fb04b8277b88250e2c184637d3130b1afa1d48fa6917c4f965ff

SHA512
b04bc6199a05ab9acd434508a92a54028f2430de7ff1d2997a24d869da6227af32ca19fcaf66f251c785e2f6685bd4adf3c6c3e295ed02f577a74a2a5fbeaac4

Download Submit
C:\Users\Admin\AppData\Local\Temp\9204.exe
MD5
5aa36223a5f699ed0367927afac55685

SHA1
91b88a596e7a36b02d9d2a5ebe77c991b37c938d

SHA256
f48b54cfc0d0418200ec86e4b6d7e7b312cfee5ce301c10e4c4b279d554cc4e3

SHA512
01f956a0ebfef2627f5c84fd676438de660a62a7d513bcd6de6e5e6a4c439721814c2c9b1da806ca5dbcaa42836dd3375ffd931b6079bded6b4ad8ad11b92d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\9204.exe
MD5
5aa36223a5f699ed0367927afac55685

SHA1
91b88a596e7a36b02d9d2a5ebe77c991b37c938d

SHA256
f48b54cfc0d0418200ec86e4b6d7e7b312cfee5ce301c10e4c4b279d554cc4e3

SHA512
01f956a0ebfef2627f5c84fd676438de660a62a7d513bcd6de6e5e6a4c439721814c2c9b1da806ca5dbcaa42836dd3375ffd931b6079bded6b4ad8ad11b92d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\9417.exe
MD5
73252acb344040ddc5d9ce78a5d3a4c2

SHA1
3a16c3698ccf7940adfb2b2a9cc8c20b1ba1d015

SHA256
b8ac77c37de98099dcdc5924418d445f4b11ecf326edd41a2d49ed6efd2a07eb

SHA512
1541e3d7bd163a4c348c6e5c7098c6f3add62b1121296ca28934a69ad308c2e51ca6b841359010da96e71fa42fd6e09f7591448433dc3b01104007808427c3de

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
C:\Users\Admin\AppData\Local\Temp\BD24.exe
MD5
8b66d2ca677914a067bdffbaad7547d9

SHA1
1c77465c5ab4d7f447320edc934f4907d8d011ad

SHA256
5b84d038e83f108e62aca1f184ab7be991b0279435069ad5de48f8bea1e2c7ce

SHA512
3313fa23eecf5ef682fa1c39c8de17d239a0c2f92abf0264b955ffa3a1b0b8488f82b6f64ba9ad4413b3598c6600e4f43146fcd1fed75320264c903997caa7be

Download Submit
C:\Users\Admin\AppData\Roaming\bbfdwvt
MD5
8b1e1484298d966a4327e86c0a31a8e4

SHA1
dfcedcd2eda71d47f32f65ce8dfe3c76c290b56f

SHA256
c6498d4425f32bb7027530a8f717b3374a2fc968f5f6f804ce17626644e17133

SHA512
e2b8c0b10081e773415b0721305a5149e2bbfe4fe0b052e835a16047cdabe069fedba35adb63bb21bf0b08ae0b6d15276d19358ec14c7d170d6709420117b4e3

Download Submit
C:\Users\Admin\AppData\Roaming\bbfdwvt
MD5
8b1e1484298d966a4327e86c0a31a8e4

SHA1
dfcedcd2eda71d47f32f65ce8dfe3c76c290b56f

SHA256
c6498d4425f32bb7027530a8f717b3374a2fc968f5f6f804ce17626644e17133

SHA512
e2b8c0b10081e773415b0721305a5149e2bbfe4fe0b052e835a16047cdabe069fedba35adb63bb21bf0b08ae0b6d15276d19358ec14c7d170d6709420117b4e3

Download Submit
C:\Users\Admin\AppData\Roaming\bbfdwvt
MD5
8b1e1484298d966a4327e86c0a31a8e4

SHA1
dfcedcd2eda71d47f32f65ce8dfe3c76c290b56f

SHA256
c6498d4425f32bb7027530a8f717b3374a2fc968f5f6f804ce17626644e17133

SHA512
e2b8c0b10081e773415b0721305a5149e2bbfe4fe0b052e835a16047cdabe069fedba35adb63bb21bf0b08ae0b6d15276d19358ec14c7d170d6709420117b4e3

Download Submit
\Users\Admin\AppData\Local\Temp\1105.tmp
MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\8AB3.exe
MD5
6082870c958221e33434c3819da0d6b0

SHA1
8ab81bd6a238b4e088e93bea97c3394b5a762749

SHA256
305ebe159194fb04b8277b88250e2c184637d3130b1afa1d48fa6917c4f965ff

SHA512
b04bc6199a05ab9acd434508a92a54028f2430de7ff1d2997a24d869da6227af32ca19fcaf66f251c785e2f6685bd4adf3c6c3e295ed02f577a74a2a5fbeaac4

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
\Users\Admin\AppData\Local\Temp\9C42.exe
MD5
e6904455750065e6351626c373eba2bb

SHA1
e2917ff943628d8e9a715c1fadf20688d3e6396e

SHA256
18d00aa5277e0aa198dcc2a3bc8cee034cb5e9c808b8220fe46fd18acc5f3010

SHA512
838d884ebabda35d4580d9cee1845115d93e5725a3d159a034364f5576baed4ccbf182a42892b8109779d22e52e11db8b57174c2babf7f3787fdf5933e9d3878

Download Submit
memory/588-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/588-56-0x0000000000402E0C-mapping.dmp

Download
memory/588-57-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/984-79-0x0000000000000000-mapping.dmp

Download
memory/984-93-0x0000000004890000-0x0000000004966000-memory.dmp

Filesize
856KB

Download
memory/984-92-0x00000000002F0000-0x000000000036C000-memory.dmp

Filesize
496KB

Download
memory/984-94-0x0000000000400000-0x0000000002F6F000-memory.dmp

Filesize
43.4MB

Download
memory/1400-59-0x0000000002560000-0x0000000002576000-memory.dmp

Filesize
88KB

Download
memory/1400-95-0x00000000042C0000-0x00000000042D6000-memory.dmp

Filesize
88KB

Download
memory/1400-90-0x0000000003E80000-0x0000000003E96000-memory.dmp

Filesize
88KB

Download
memory/1460-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1460-73-0x0000000000402EE8-mapping.dmp

Download
memory/1472-96-0x0000000000000000-mapping.dmp

Download
memory/1516-85-0x0000000000400000-0x0000000002EFA000-memory.dmp

Filesize
43.0MB

Download
memory/1516-84-0x0000000000250000-0x0000000000259000-memory.dmp

Filesize
36KB

Download
memory/1516-67-0x0000000000000000-mapping.dmp

Download
memory/1516-83-0x00000000001C0000-0x00000000001C8000-memory.dmp

Filesize
32KB

Download
memory/1612-58-0x0000000000020000-0x0000000000029000-memory.dmp

Filesize
36KB

Download
memory/1612-54-0x0000000000A48000-0x0000000000A59000-memory.dmp

Filesize
68KB

Download
memory/1648-87-0x0000000000460000-0x000000000047E000-memory.dmp

Filesize
120KB

Download
memory/1648-65-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1648-62-0x0000000000000000-mapping.dmp

Download
memory/1648-81-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1648-78-0x00000000003E0000-0x00000000003E3000-memory.dmp

Filesize
12KB

Download
memory/1648-88-0x0000000001E90000-0x0000000001EAA000-memory.dmp

Filesize
104KB

Download
memory/1676-115-0x0000000000402E0C-mapping.dmp

Download
memory/1696-109-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/1696-100-0x0000000000000000-mapping.dmp

Download
memory/1740-69-0x0000000000648000-0x0000000000658000-memory.dmp

Filesize
64KB

Download
memory/1740-74-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1740-60-0x0000000000000000-mapping.dmp

Download
memory/1996-111-0x0000000000000000-mapping.dmp

Download
memory/1996-113-0x00000000009E8000-0x00000000009F9000-memory.dmp

Filesize
68KB

Download