Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
16-11-2021 13:34
Static task
static1
Behavioral task
behavioral1
Sample
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe
Resource
win10-en-20211014
General
-
Target
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe
-
Size
326KB
-
MD5
739b497fa91e90193c649338ca8fcbce
-
SHA1
faba0ec2f6e2190be027015f2eae23b55525250c
-
SHA256
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b
-
SHA512
93d75e63e3ab18a640b3313babf52ad5b8db01c505d72e74a3e56cb4303564f11338df84f575db2a87d8d4d4ad9c2d88dbfaa2fcce2fb0e76f267fed703b9245
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
Extracted
redline
185.159.80.90:38637
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
redline
imbest
45.153.186.153:56675
Extracted
vidar
48.5
706
https://koyu.space/@tttaj
-
profile_id
706
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/396-144-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/396-145-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/3832-178-0x0000000004380000-0x00000000043AD000-memory.dmp family_redline behavioral1/memory/3832-180-0x0000000004810000-0x000000000483C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3140 created 3060 3140 WerFault.exe FF13.exe -
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3060-202-0x0000000004500000-0x00000000045D5000-memory.dmp family_vidar behavioral1/memory/3060-203-0x0000000000400000-0x00000000027E5000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 11 IoCs
Processes:
3A55.exe3A55.exe509E.exe5ED7.exe509E.exe77EE.exeAD57.exeDE0D.exeFF13.exe2941.exeGEpth.eXepid process 68 3A55.exe 3184 3A55.exe 3456 509E.exe 3484 5ED7.exe 396 509E.exe 4056 77EE.exe 2420 AD57.exe 3832 DE0D.exe 3060 FF13.exe 68 2941.exe 1768 GEpth.eXe -
Deletes itself 1 IoCs
Processes:
pid process 2580 -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exepid process 1628 regsvr32.exe 1628 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe3A55.exe509E.exedescription pid process target process PID 3816 set thread context of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 68 set thread context of 3184 68 3A55.exe 3A55.exe PID 3456 set thread context of 396 3456 509E.exe 509E.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1684 2420 WerFault.exe AD57.exe 3140 3060 WerFault.exe FF13.exe -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3A55.exe5ED7.exe5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3A55.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3A55.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5ED7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5ED7.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3A55.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5ED7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3620 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exepid process 856 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 856 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 2580 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2580 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe3A55.exe5ED7.exepid process 856 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 3184 3A55.exe 3484 5ED7.exe 2580 2580 2580 2580 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
509E.exeWerFault.exeDE0D.exeWerFault.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeDebugPrivilege 396 509E.exe Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeRestorePrivilege 1684 WerFault.exe Token: SeBackupPrivilege 1684 WerFault.exe Token: SeDebugPrivilege 1684 WerFault.exe Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeDebugPrivilege 3832 DE0D.exe Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeDebugPrivilege 3140 WerFault.exe Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeDebugPrivilege 3620 taskkill.exe Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 Token: SeCreatePagefilePrivilege 2580 Token: SeShutdownPrivilege 2580 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe3A55.exe509E.exe2941.exemshta.execmd.exeGEpth.eXedescription pid process target process PID 3816 wrote to memory of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 3816 wrote to memory of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 3816 wrote to memory of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 3816 wrote to memory of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 3816 wrote to memory of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 3816 wrote to memory of 856 3816 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe 5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe PID 2580 wrote to memory of 68 2580 3A55.exe PID 2580 wrote to memory of 68 2580 3A55.exe PID 2580 wrote to memory of 68 2580 3A55.exe PID 68 wrote to memory of 3184 68 3A55.exe 3A55.exe PID 68 wrote to memory of 3184 68 3A55.exe 3A55.exe PID 68 wrote to memory of 3184 68 3A55.exe 3A55.exe PID 68 wrote to memory of 3184 68 3A55.exe 3A55.exe PID 68 wrote to memory of 3184 68 3A55.exe 3A55.exe PID 68 wrote to memory of 3184 68 3A55.exe 3A55.exe PID 2580 wrote to memory of 3456 2580 509E.exe PID 2580 wrote to memory of 3456 2580 509E.exe PID 2580 wrote to memory of 3456 2580 509E.exe PID 2580 wrote to memory of 3484 2580 5ED7.exe PID 2580 wrote to memory of 3484 2580 5ED7.exe PID 2580 wrote to memory of 3484 2580 5ED7.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 3456 wrote to memory of 396 3456 509E.exe 509E.exe PID 2580 wrote to memory of 4056 2580 77EE.exe PID 2580 wrote to memory of 4056 2580 77EE.exe PID 2580 wrote to memory of 4056 2580 77EE.exe PID 2580 wrote to memory of 2420 2580 AD57.exe PID 2580 wrote to memory of 2420 2580 AD57.exe PID 2580 wrote to memory of 2420 2580 AD57.exe PID 2580 wrote to memory of 3832 2580 DE0D.exe PID 2580 wrote to memory of 3832 2580 DE0D.exe PID 2580 wrote to memory of 3832 2580 DE0D.exe PID 2580 wrote to memory of 3060 2580 FF13.exe PID 2580 wrote to memory of 3060 2580 FF13.exe PID 2580 wrote to memory of 3060 2580 FF13.exe PID 2580 wrote to memory of 68 2580 2941.exe PID 2580 wrote to memory of 68 2580 2941.exe PID 2580 wrote to memory of 68 2580 2941.exe PID 2580 wrote to memory of 1964 2580 explorer.exe PID 2580 wrote to memory of 1964 2580 explorer.exe PID 2580 wrote to memory of 1964 2580 explorer.exe PID 2580 wrote to memory of 1964 2580 explorer.exe PID 2580 wrote to memory of 1232 2580 explorer.exe PID 2580 wrote to memory of 1232 2580 explorer.exe PID 2580 wrote to memory of 1232 2580 explorer.exe PID 68 wrote to memory of 676 68 2941.exe mshta.exe PID 68 wrote to memory of 676 68 2941.exe mshta.exe PID 68 wrote to memory of 676 68 2941.exe mshta.exe PID 676 wrote to memory of 3508 676 mshta.exe cmd.exe PID 676 wrote to memory of 3508 676 mshta.exe cmd.exe PID 676 wrote to memory of 3508 676 mshta.exe cmd.exe PID 3508 wrote to memory of 1768 3508 cmd.exe GEpth.eXe PID 3508 wrote to memory of 1768 3508 cmd.exe GEpth.eXe PID 3508 wrote to memory of 1768 3508 cmd.exe GEpth.eXe PID 3508 wrote to memory of 3620 3508 cmd.exe taskkill.exe PID 3508 wrote to memory of 3620 3508 cmd.exe taskkill.exe PID 3508 wrote to memory of 3620 3508 cmd.exe taskkill.exe PID 1768 wrote to memory of 3200 1768 GEpth.eXe mshta.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe"C:\Users\Admin\AppData\Local\Temp\5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe"C:\Users\Admin\AppData\Local\Temp\5241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3A55.exeC:\Users\Admin\AppData\Local\Temp\3A55.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3A55.exeC:\Users\Admin\AppData\Local\Temp\3A55.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\509E.exeC:\Users\Admin\AppData\Local\Temp\509E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\509E.exeC:\Users\Admin\AppData\Local\Temp\509E.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5ED7.exeC:\Users\Admin\AppData\Local\Temp\5ED7.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\77EE.exeC:\Users\Admin\AppData\Local\Temp\77EE.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AD57.exeC:\Users\Admin\AppData\Local\Temp\AD57.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 4042⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DE0D.exeC:\Users\Admin\AppData\Local\Temp\DE0D.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FF13.exeC:\Users\Admin\AppData\Local\Temp\FF13.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 9522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2941.exeC:\Users\Admin\AppData\Local\Temp\2941.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScriPt: clOse( CrEateObjECT( "Wscript.SHELL"). RUn ("CmD.EXe /Q /R TYpE ""C:\Users\Admin\AppData\Local\Temp\2941.exe"" > ..\GEpth.eXe && sTaRT ..\GEpTH.eXE /PWvkDiYa1vO4kkeo6dmUXtDkxgvu &IF """" == """" for %z in (""C:\Users\Admin\AppData\Local\Temp\2941.exe"") do taskkill /IM ""%~nXz"" -F " , 0, true) )2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R TYpE "C:\Users\Admin\AppData\Local\Temp\2941.exe" > ..\GEpth.eXe && sTaRT ..\GEpTH.eXE /PWvkDiYa1vO4kkeo6dmUXtDkxgvu &IF "" =="" for %z in ("C:\Users\Admin\AppData\Local\Temp\2941.exe") do taskkill /IM "%~nXz" -F3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GEpth.eXe..\GEpTH.eXE /PWvkDiYa1vO4kkeo6dmUXtDkxgvu4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBScriPt: clOse( CrEateObjECT( "Wscript.SHELL"). RUn ("CmD.EXe /Q /R TYpE ""C:\Users\Admin\AppData\Local\Temp\GEpth.eXe"" > ..\GEpth.eXe && sTaRT ..\GEpTH.eXE /PWvkDiYa1vO4kkeo6dmUXtDkxgvu &IF ""/PWvkDiYa1vO4kkeo6dmUXtDkxgvu "" == """" for %z in (""C:\Users\Admin\AppData\Local\Temp\GEpth.eXe"") do taskkill /IM ""%~nXz"" -F " , 0, true) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R TYpE "C:\Users\Admin\AppData\Local\Temp\GEpth.eXe" > ..\GEpth.eXe && sTaRT ..\GEpTH.eXE /PWvkDiYa1vO4kkeo6dmUXtDkxgvu &IF "/PWvkDiYa1vO4kkeo6dmUXtDkxgvu " =="" for %z in ("C:\Users\Admin\AppData\Local\Temp\GEpth.eXe") do taskkill /IM "%~nXz" -F6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRipt: clOse ( CrEAteoBJEcT ( "wSCRipT.shEll" ). rUn ( "cMD /r Echo | sET /P = ""MZ"" > b_YXEl0G._J & CoPY /Y /B b_YXEL0G._J+ VJM7A_.O + RTKwu.VjJ ..\F3Os.H & del /q *& staRt regsvr32 -u /s ..\f3OS.H " ,0 , trUE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | sET /P = "MZ" > b_YXEl0G._J & CoPY /Y /B b_YXEL0G._J+ VJM7A_.O + RTKwu.VjJ ..\F3Os.H & del /q *& staRt regsvr32 -u /s ..\f3OS.H6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /P = "MZ" 1>b_YXEl0G._J"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 -u /s ..\f3OS.H7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "2941.exe" -F4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\509E.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\2941.exeMD5
d8a81f4f7e64f2e5f3c4bef85c23931b
SHA16df6b63f7c717945d57ac8e9189efb1c42aa6a24
SHA256361cd0082558c6df0e588cb71d77115f58d1880242a713e2bb74b02e19d6b4bd
SHA51298d196ed25be9d2f2471f8ef0a737f50705975ff93fc2451b588e89d9b4fe866352e8e5904b9140f1c7bcc7fcad8748c637253922caa091fb17ebcf08f8243f5
-
C:\Users\Admin\AppData\Local\Temp\2941.exeMD5
d8a81f4f7e64f2e5f3c4bef85c23931b
SHA16df6b63f7c717945d57ac8e9189efb1c42aa6a24
SHA256361cd0082558c6df0e588cb71d77115f58d1880242a713e2bb74b02e19d6b4bd
SHA51298d196ed25be9d2f2471f8ef0a737f50705975ff93fc2451b588e89d9b4fe866352e8e5904b9140f1c7bcc7fcad8748c637253922caa091fb17ebcf08f8243f5
-
C:\Users\Admin\AppData\Local\Temp\3A55.exeMD5
739b497fa91e90193c649338ca8fcbce
SHA1faba0ec2f6e2190be027015f2eae23b55525250c
SHA2565241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b
SHA51293d75e63e3ab18a640b3313babf52ad5b8db01c505d72e74a3e56cb4303564f11338df84f575db2a87d8d4d4ad9c2d88dbfaa2fcce2fb0e76f267fed703b9245
-
C:\Users\Admin\AppData\Local\Temp\3A55.exeMD5
739b497fa91e90193c649338ca8fcbce
SHA1faba0ec2f6e2190be027015f2eae23b55525250c
SHA2565241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b
SHA51293d75e63e3ab18a640b3313babf52ad5b8db01c505d72e74a3e56cb4303564f11338df84f575db2a87d8d4d4ad9c2d88dbfaa2fcce2fb0e76f267fed703b9245
-
C:\Users\Admin\AppData\Local\Temp\3A55.exeMD5
739b497fa91e90193c649338ca8fcbce
SHA1faba0ec2f6e2190be027015f2eae23b55525250c
SHA2565241bfe2b10e10c08c3ed731298b27dfd708be81460ad281dab3e6987e41712b
SHA51293d75e63e3ab18a640b3313babf52ad5b8db01c505d72e74a3e56cb4303564f11338df84f575db2a87d8d4d4ad9c2d88dbfaa2fcce2fb0e76f267fed703b9245
-
C:\Users\Admin\AppData\Local\Temp\509E.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\509E.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\509E.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\5ED7.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\5ED7.exeMD5
d985b4cfdceecc3c0fe4f3e4fda4e416
SHA1f3c14a4d87569e54faaf0eac73ec1aafa2621dfa
SHA256a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7
SHA512560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c
-
C:\Users\Admin\AppData\Local\Temp\77EE.exeMD5
8f79110737dc06d512478b5f7d8d5c2b
SHA16c1cb2cb48d77ec4bb4e500f0fa7ab873d35e063
SHA256bf5031c61e39f9dfb379eba03181bfc5bdc63527c25588279fc9e2684e462c11
SHA512efc3b733905b6266d17c33ef8e091307ea6afcef2d1f292431ffc6701eb07d49197512d24d583f82781f9eccad4084c808ce547e82deaec28f1adac8251836e6
-
C:\Users\Admin\AppData\Local\Temp\77EE.exeMD5
8f79110737dc06d512478b5f7d8d5c2b
SHA16c1cb2cb48d77ec4bb4e500f0fa7ab873d35e063
SHA256bf5031c61e39f9dfb379eba03181bfc5bdc63527c25588279fc9e2684e462c11
SHA512efc3b733905b6266d17c33ef8e091307ea6afcef2d1f292431ffc6701eb07d49197512d24d583f82781f9eccad4084c808ce547e82deaec28f1adac8251836e6
-
C:\Users\Admin\AppData\Local\Temp\AD57.exeMD5
7110ac78a317961aab57b05e34f6e283
SHA1df2b44503905927d560cc4fc5215e3c6fc900177
SHA25616dbdb3363f27163fa3d862ed38a1f2e69f654f9116907004fe351840861d055
SHA5126b2433e0313042d988f6eb0f2ebaafb32940bc782d6711945ab1a9cc5dcf4eed9321f222eddd5bc96f53d438a0cd9475b06778fd567b789488a6d0b6da06b9ba
-
C:\Users\Admin\AppData\Local\Temp\AD57.exeMD5
7110ac78a317961aab57b05e34f6e283
SHA1df2b44503905927d560cc4fc5215e3c6fc900177
SHA25616dbdb3363f27163fa3d862ed38a1f2e69f654f9116907004fe351840861d055
SHA5126b2433e0313042d988f6eb0f2ebaafb32940bc782d6711945ab1a9cc5dcf4eed9321f222eddd5bc96f53d438a0cd9475b06778fd567b789488a6d0b6da06b9ba
-
C:\Users\Admin\AppData\Local\Temp\DE0D.exeMD5
841bf64a05dc864c9250a33e5d29e487
SHA19da1471e9384e54014758c446d0876750c2b0b60
SHA256e0a69e559bd17ce762725250a638045f4cbd43d2d0b81282e8130b08674d6577
SHA5127bdc311997205648a53bb760928cbd519a9797ef761feccd9724ffea6c444dde255f0c590274a096a7e44d088d3ad1dfe144361955aecc43bb571d479d45c609
-
C:\Users\Admin\AppData\Local\Temp\DE0D.exeMD5
841bf64a05dc864c9250a33e5d29e487
SHA19da1471e9384e54014758c446d0876750c2b0b60
SHA256e0a69e559bd17ce762725250a638045f4cbd43d2d0b81282e8130b08674d6577
SHA5127bdc311997205648a53bb760928cbd519a9797ef761feccd9724ffea6c444dde255f0c590274a096a7e44d088d3ad1dfe144361955aecc43bb571d479d45c609
-
C:\Users\Admin\AppData\Local\Temp\FF13.exeMD5
45000094e1ee0af8e4dcdaa1af8ce0fa
SHA1c0fb127966c91aa25cb33875361932bfd8dad5f4
SHA2564412b5fa2e6efb398f21fec2d6387832abf5b9a78053d8f56c11cdeaa845831d
SHA5120ec4b96b615ccbc7c5dd1c9cb182ea2f51b8961357949b0d0091ed2d0ceb266d57b2c8de4006b333d823280ce28a1dffe1b7393923969029ab4dd226b45fd981
-
C:\Users\Admin\AppData\Local\Temp\FF13.exeMD5
45000094e1ee0af8e4dcdaa1af8ce0fa
SHA1c0fb127966c91aa25cb33875361932bfd8dad5f4
SHA2564412b5fa2e6efb398f21fec2d6387832abf5b9a78053d8f56c11cdeaa845831d
SHA5120ec4b96b615ccbc7c5dd1c9cb182ea2f51b8961357949b0d0091ed2d0ceb266d57b2c8de4006b333d823280ce28a1dffe1b7393923969029ab4dd226b45fd981
-
C:\Users\Admin\AppData\Local\Temp\GEpth.eXeMD5
d8a81f4f7e64f2e5f3c4bef85c23931b
SHA16df6b63f7c717945d57ac8e9189efb1c42aa6a24
SHA256361cd0082558c6df0e588cb71d77115f58d1880242a713e2bb74b02e19d6b4bd
SHA51298d196ed25be9d2f2471f8ef0a737f50705975ff93fc2451b588e89d9b4fe866352e8e5904b9140f1c7bcc7fcad8748c637253922caa091fb17ebcf08f8243f5
-
C:\Users\Admin\AppData\Local\Temp\GEpth.eXeMD5
d8a81f4f7e64f2e5f3c4bef85c23931b
SHA16df6b63f7c717945d57ac8e9189efb1c42aa6a24
SHA256361cd0082558c6df0e588cb71d77115f58d1880242a713e2bb74b02e19d6b4bd
SHA51298d196ed25be9d2f2471f8ef0a737f50705975ff93fc2451b588e89d9b4fe866352e8e5904b9140f1c7bcc7fcad8748c637253922caa091fb17ebcf08f8243f5
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\VjM7A_.OMD5
640d61152bd2275e1943dde411c1c0df
SHA16f536b58b05546d2175ff35485901b90df46e642
SHA256e81b03ee8fa401688c12afcc77b2d699c6c557866c078764fcec5834dffd75ac
SHA512e586e199587aa5e156c9dd40498a18323980993e7c43958cfb685b0daebaa0df64fc81ecb025622b93d847bad3d5509182cf335f97cef791d99d7696e3a996d4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\b_YXEl0G._JMD5
ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\rtKwu.vjJMD5
e277cbe00c6606584bce930b2f3218c9
SHA16d09be44853b22c9f80cba50bbc4fff89f060f47
SHA256c8d287f65ccac6630495d8d41ca85c51b3c9cc76b6c492bd4894df57339ccfd9
SHA51286d17f539da1a73f7dc25f2128a4df933246f976ad66b6ec04ecc4219a3079d061df6ed5529c075c400db2f52d3e2cf6f18325f75d4e46f55030557e71159229
-
\Users\Admin\AppData\Local\Temp\F3Os.HMD5
cfb22a4a48cf1c24eeef631e67283d56
SHA1744aeeaaf90e106bbf75221c9d4fad46932ce982
SHA25655cc67642bf23f39a6aeeb46155b73379ff86a9153f904ff3177f5c3b131b077
SHA5126e43366f8f283337b13dda1979fb440434b71b67772414cc050075d31ece46b2b4c8df2ebc7f586b53aff9cf1dc309539af45ad513916a46cc074e4eaec6d1a4
-
\Users\Admin\AppData\Local\Temp\F3Os.HMD5
cfb22a4a48cf1c24eeef631e67283d56
SHA1744aeeaaf90e106bbf75221c9d4fad46932ce982
SHA25655cc67642bf23f39a6aeeb46155b73379ff86a9153f904ff3177f5c3b131b077
SHA5126e43366f8f283337b13dda1979fb440434b71b67772414cc050075d31ece46b2b4c8df2ebc7f586b53aff9cf1dc309539af45ad513916a46cc074e4eaec6d1a4
-
memory/68-207-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/68-206-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/68-120-0x0000000000000000-mapping.dmp
-
memory/68-123-0x0000000002568000-0x0000000002578000-memory.dmpFilesize
64KB
-
memory/68-204-0x0000000000000000-mapping.dmp
-
memory/68-127-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/396-153-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/396-150-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/396-144-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/396-154-0x0000000005290000-0x0000000005896000-memory.dmpFilesize
6.0MB
-
memory/396-155-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/396-166-0x00000000062E0000-0x00000000062E1000-memory.dmpFilesize
4KB
-
memory/396-145-0x0000000000418EEA-mapping.dmp
-
memory/396-168-0x0000000006E60000-0x0000000006E61000-memory.dmpFilesize
4KB
-
memory/396-151-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/396-169-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/396-164-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/396-152-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/588-225-0x0000000000000000-mapping.dmp
-
memory/676-215-0x0000000000000000-mapping.dmp
-
memory/796-227-0x0000000000000000-mapping.dmp
-
memory/856-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/856-117-0x0000000000402DD8-mapping.dmp
-
memory/1232-212-0x0000000000000000-mapping.dmp
-
memory/1232-213-0x0000000000900000-0x0000000000907000-memory.dmpFilesize
28KB
-
memory/1232-214-0x00000000008F0000-0x00000000008FC000-memory.dmpFilesize
48KB
-
memory/1628-232-0x0000000000000000-mapping.dmp
-
memory/1768-220-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1768-217-0x0000000000000000-mapping.dmp
-
memory/1768-219-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/1964-211-0x0000000000360000-0x00000000003CB000-memory.dmpFilesize
428KB
-
memory/1964-210-0x0000000000600000-0x0000000000674000-memory.dmpFilesize
464KB
-
memory/1964-209-0x0000000000000000-mapping.dmp
-
memory/2120-228-0x0000000000000000-mapping.dmp
-
memory/2420-173-0x0000000002670000-0x00000000026D0000-memory.dmpFilesize
384KB
-
memory/2420-170-0x0000000000000000-mapping.dmp
-
memory/2580-119-0x0000000000D50000-0x0000000000D66000-memory.dmpFilesize
88KB
-
memory/2580-140-0x0000000002A10000-0x0000000002A26000-memory.dmpFilesize
88KB
-
memory/2580-159-0x0000000002DF0000-0x0000000002E06000-memory.dmpFilesize
88KB
-
memory/2828-224-0x0000000000000000-mapping.dmp
-
memory/3060-192-0x0000000000000000-mapping.dmp
-
memory/3060-202-0x0000000004500000-0x00000000045D5000-memory.dmpFilesize
852KB
-
memory/3060-203-0x0000000000400000-0x00000000027E5000-memory.dmpFilesize
35.9MB
-
memory/3060-201-0x00000000028C8000-0x0000000002944000-memory.dmpFilesize
496KB
-
memory/3184-125-0x0000000000402DD8-mapping.dmp
-
memory/3200-223-0x0000000000000000-mapping.dmp
-
memory/3456-135-0x0000000004BB0000-0x0000000004C26000-memory.dmpFilesize
472KB
-
memory/3456-134-0x00000000025A0000-0x00000000025A1000-memory.dmpFilesize
4KB
-
memory/3456-133-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3456-139-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/3456-131-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/3456-128-0x0000000000000000-mapping.dmp
-
memory/3484-142-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/3484-136-0x0000000000000000-mapping.dmp
-
memory/3484-143-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3484-141-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/3508-216-0x0000000000000000-mapping.dmp
-
memory/3620-221-0x0000000000000000-mapping.dmp
-
memory/3816-115-0x00000000024B9000-0x00000000024CA000-memory.dmpFilesize
68KB
-
memory/3816-118-0x0000000002410000-0x00000000024BE000-memory.dmpFilesize
696KB
-
memory/3832-184-0x0000000006E42000-0x0000000006E43000-memory.dmpFilesize
4KB
-
memory/3832-180-0x0000000004810000-0x000000000483C000-memory.dmpFilesize
176KB
-
memory/3832-182-0x0000000000400000-0x0000000002795000-memory.dmpFilesize
35.6MB
-
memory/3832-183-0x0000000006E40000-0x0000000006E41000-memory.dmpFilesize
4KB
-
memory/3832-174-0x0000000000000000-mapping.dmp
-
memory/3832-185-0x0000000006E43000-0x0000000006E44000-memory.dmpFilesize
4KB
-
memory/3832-178-0x0000000004380000-0x00000000043AD000-memory.dmpFilesize
180KB
-
memory/3832-181-0x0000000004290000-0x00000000042C9000-memory.dmpFilesize
228KB
-
memory/3832-191-0x0000000006E44000-0x0000000006E46000-memory.dmpFilesize
8KB
-
memory/3940-226-0x0000000000000000-mapping.dmp
-
memory/4056-156-0x0000000000000000-mapping.dmp
-
memory/4056-162-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/4056-161-0x0000000002170000-0x00000000021FF000-memory.dmpFilesize
572KB
-
memory/4056-160-0x0000000000600000-0x000000000064F000-memory.dmpFilesize
316KB