Analysis
-
max time kernel
65s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
20/11/2021, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe
Resource
win7-en-20211104
General
-
Target
734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe
-
Size
3.4MB
-
MD5
911669a9c6aedd2806a996ad49adac13
-
SHA1
7b0ad38d008d1c7a40e2575b005e9876aca4f06d
-
SHA256
734c31431b89b7501b984af35a2d61bdce27ba87ca484a64fb37ca5794e1a141
-
SHA512
457d387f2b087fd2c3701d9f468032878c5944c4cba352fc9b5a7befdd3944b8694590800c4c76d72a6aac3717f59bac27f713d13c45bdebdcd26bac338500a0
Malware Config
Extracted
vidar
40
706
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
redline
pab3
185.215.113.15:61506
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/1600-192-0x0000000002D60000-0x0000000002D7C000-memory.dmp family_redline behavioral1/memory/1600-195-0x0000000003020000-0x000000000303A000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/1064-173-0x0000000003320000-0x00000000033BD000-memory.dmp family_vidar behavioral1/memory/1064-184-0x0000000000400000-0x0000000002D1A000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x00070000000121fa-65.dat aspack_v212_v242 behavioral1/files/0x00070000000121fa-66.dat aspack_v212_v242 behavioral1/files/0x0006000000012200-64.dat aspack_v212_v242 behavioral1/files/0x0006000000012200-63.dat aspack_v212_v242 behavioral1/files/0x0006000000012204-70.dat aspack_v212_v242 behavioral1/files/0x0006000000012204-69.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
pid Process 1412 setup_install.exe 668 Tue09a700e547.exe 1064 Tue0920739b1b1367340.exe 1892 Tue09ca5dc30ca0.exe 2012 Tue090358524773b93.exe 1444 Tue094bcd3f59.exe 528 Tue098c67724cc.exe 1600 Tue094093eaba3241.exe 972 Tue095a91fcf60e296.exe 1912 Tue09a700e547.exe 1724 Tue09d48d6e278d9ad1.exe 852 Volevo.exe.com 2044 Volevo.exe.com 2564 XYOdYgjQCuIIVxIpVRzek2lQ.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Control Panel\International\Geo\Nation Tue090358524773b93.exe -
Loads dropped DLL 53 IoCs
pid Process 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 1412 setup_install.exe 1412 setup_install.exe 1412 setup_install.exe 1412 setup_install.exe 1412 setup_install.exe 1412 setup_install.exe 1412 setup_install.exe 1412 setup_install.exe 1960 cmd.exe 1536 cmd.exe 1788 cmd.exe 1960 cmd.exe 1788 cmd.exe 992 cmd.exe 1536 cmd.exe 1904 cmd.exe 1144 cmd.exe 1144 cmd.exe 668 Tue09a700e547.exe 668 Tue09a700e547.exe 876 cmd.exe 1064 Tue0920739b1b1367340.exe 1064 Tue0920739b1b1367340.exe 1892 Tue09ca5dc30ca0.exe 1892 Tue09ca5dc30ca0.exe 2012 Tue090358524773b93.exe 2012 Tue090358524773b93.exe 1688 cmd.exe 1600 Tue094093eaba3241.exe 1600 Tue094093eaba3241.exe 668 Tue09a700e547.exe 1068 cmd.exe 1724 Tue09d48d6e278d9ad1.exe 1724 Tue09d48d6e278d9ad1.exe 1912 Tue09a700e547.exe 1912 Tue09a700e547.exe 1200 cmd.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 852 Volevo.exe.com 1404 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2012 Tue090358524773b93.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce Tue09d48d6e278d9ad1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Tue09d48d6e278d9ad1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 64 ipinfo.io 65 ipinfo.io 211 ip-api.com -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1404 1412 WerFault.exe 28 2328 1064 WerFault.exe 42 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue09ca5dc30ca0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue09ca5dc30ca0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Tue09ca5dc30ca0.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tue0920739b1b1367340.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tue0920739b1b1367340.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Tue0920739b1b1367340.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1076 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1892 Tue09ca5dc30ca0.exe 1892 Tue09ca5dc30ca0.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1404 WerFault.exe 1392 Process not Found 1392 Process not Found 1392 Process not Found 672 powershell.exe 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 2328 WerFault.exe 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found 1392 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1892 Tue09ca5dc30ca0.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1600 Tue094093eaba3241.exe Token: SeDebugPrivilege 972 Tue095a91fcf60e296.exe Token: SeDebugPrivilege 528 Tue098c67724cc.exe Token: SeDebugPrivilege 1404 WerFault.exe Token: SeDebugPrivilege 672 powershell.exe Token: SeDebugPrivilege 2328 WerFault.exe Token: SeShutdownPrivilege 1392 Process not Found -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 852 Volevo.exe.com 852 Volevo.exe.com 852 Volevo.exe.com 2044 Volevo.exe.com 2044 Volevo.exe.com 2044 Volevo.exe.com -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 852 Volevo.exe.com 852 Volevo.exe.com 852 Volevo.exe.com 2044 Volevo.exe.com 2044 Volevo.exe.com 2044 Volevo.exe.com -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 844 wrote to memory of 1412 844 734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe 28 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1300 1412 setup_install.exe 32 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1960 1412 setup_install.exe 31 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1536 1412 setup_install.exe 30 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1904 1412 setup_install.exe 36 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1788 1412 setup_install.exe 35 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 1144 1412 setup_install.exe 34 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 992 1412 setup_install.exe 33 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1688 1412 setup_install.exe 38 PID 1412 wrote to memory of 1068 1412 setup_install.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe"C:\Users\Admin\AppData\Local\Temp\734C31431B89B7501B984AF35A2D61BDCE27BA87CA484.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue09ca5dc30ca0.exe3⤵
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue09ca5dc30ca0.exeTue09ca5dc30ca0.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1892
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue09a700e547.exe3⤵
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue09a700e547.exeTue09a700e547.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:668 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue09a700e547.exe"C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue09a700e547.exe" -a5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵PID:1300
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:672
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue090358524773b93.exe3⤵
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue090358524773b93.exeTue090358524773b93.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\Pictures\Adobe Films\XYOdYgjQCuIIVxIpVRzek2lQ.exe"C:\Users\Admin\Pictures\Adobe Films\XYOdYgjQCuIIVxIpVRzek2lQ.exe"5⤵
- Executes dropped EXE
PID:2564
-
-
C:\Users\Admin\Pictures\Adobe Films\MsAjtDqynxNTifEUVCGsOJbG.exe"C:\Users\Admin\Pictures\Adobe Films\MsAjtDqynxNTifEUVCGsOJbG.exe"5⤵PID:2724
-
-
C:\Users\Admin\Pictures\Adobe Films\_15ICYesImcuYdyTYXLbymkh.exe"C:\Users\Admin\Pictures\Adobe Films\_15ICYesImcuYdyTYXLbymkh.exe"5⤵PID:2744
-
-
C:\Users\Admin\Pictures\Adobe Films\b7h9yPRVRo5jWijSuBjAZZts.exe"C:\Users\Admin\Pictures\Adobe Films\b7h9yPRVRo5jWijSuBjAZZts.exe"5⤵PID:2804
-
-
C:\Users\Admin\Pictures\Adobe Films\qb_VUWlfik0wJrymkYLNX_bm.exe"C:\Users\Admin\Pictures\Adobe Films\qb_VUWlfik0wJrymkYLNX_bm.exe"5⤵PID:2788
-
-
C:\Users\Admin\Pictures\Adobe Films\8oNv5bVmfjDCJvRkiREXrxZZ.exe"C:\Users\Admin\Pictures\Adobe Films\8oNv5bVmfjDCJvRkiREXrxZZ.exe"5⤵PID:2780
-
-
C:\Users\Admin\Pictures\Adobe Films\MSWsCbiJmTmFnhsHWyIYUh1U.exe"C:\Users\Admin\Pictures\Adobe Films\MSWsCbiJmTmFnhsHWyIYUh1U.exe"5⤵PID:2820
-
-
C:\Users\Admin\Pictures\Adobe Films\f73QlcL_R77zdPuKB4waaXzP.exe"C:\Users\Admin\Pictures\Adobe Films\f73QlcL_R77zdPuKB4waaXzP.exe"5⤵PID:2836
-
-
C:\Users\Admin\Pictures\Adobe Films\plFjS4NTD6yY1mLyx_Db3EQF.exe"C:\Users\Admin\Pictures\Adobe Films\plFjS4NTD6yY1mLyx_Db3EQF.exe"5⤵PID:2848
-
-
C:\Users\Admin\Pictures\Adobe Films\UoU3qDWxtt7g2aA9aHuAopuu.exe"C:\Users\Admin\Pictures\Adobe Films\UoU3qDWxtt7g2aA9aHuAopuu.exe"5⤵PID:2856
-
-
C:\Users\Admin\Pictures\Adobe Films\eOe_bV38My25Mzt7admCARlM.exe"C:\Users\Admin\Pictures\Adobe Films\eOe_bV38My25Mzt7admCARlM.exe"5⤵PID:2908
-
-
C:\Users\Admin\Pictures\Adobe Films\itPmB7unLBDnjtyM5wMGaMG6.exe"C:\Users\Admin\Pictures\Adobe Films\itPmB7unLBDnjtyM5wMGaMG6.exe"5⤵PID:2888
-
-
C:\Users\Admin\Pictures\Adobe Films\7PhGa2bajyHm1vh8Ls_hdCyc.exe"C:\Users\Admin\Pictures\Adobe Films\7PhGa2bajyHm1vh8Ls_hdCyc.exe"5⤵PID:3052
-
-
C:\Users\Admin\Pictures\Adobe Films\0XYneNCwZif1XGbt_pZ2bXll.exe"C:\Users\Admin\Pictures\Adobe Films\0XYneNCwZif1XGbt_pZ2bXll.exe"5⤵PID:3040
-
-
C:\Users\Admin\Pictures\Adobe Films\7uKIox23mDd2K5eEHRPHtzpn.exe"C:\Users\Admin\Pictures\Adobe Films\7uKIox23mDd2K5eEHRPHtzpn.exe"5⤵PID:3028
-
-
C:\Users\Admin\Pictures\Adobe Films\nTl_bPVJb4rq3P8JbAQI_CX_.exe"C:\Users\Admin\Pictures\Adobe Films\nTl_bPVJb4rq3P8JbAQI_CX_.exe"5⤵PID:3016
-
-
C:\Users\Admin\Pictures\Adobe Films\ZJEwOu96xZdfH5AMkJa5r2xt.exe"C:\Users\Admin\Pictures\Adobe Films\ZJEwOu96xZdfH5AMkJa5r2xt.exe"5⤵PID:3004
-
-
C:\Users\Admin\Pictures\Adobe Films\UH8CdZzmZ_klkcFuG9cwvJhF.exe"C:\Users\Admin\Pictures\Adobe Films\UH8CdZzmZ_klkcFuG9cwvJhF.exe"5⤵PID:2992
-
-
C:\Users\Admin\Pictures\Adobe Films\1sFXrDxO_5FqEZqwA9sMVAnp.exe"C:\Users\Admin\Pictures\Adobe Films\1sFXrDxO_5FqEZqwA9sMVAnp.exe"5⤵PID:2980
-
-
C:\Users\Admin\Pictures\Adobe Films\nAHibJPxYFqupS0g2Emum_HY.exe"C:\Users\Admin\Pictures\Adobe Films\nAHibJPxYFqupS0g2Emum_HY.exe"5⤵PID:2968
-
-
C:\Users\Admin\Pictures\Adobe Films\hRYXJBw3oipEdBH8mnE1YQIB.exe"C:\Users\Admin\Pictures\Adobe Films\hRYXJBw3oipEdBH8mnE1YQIB.exe"5⤵PID:2952
-
-
C:\Users\Admin\Pictures\Adobe Films\DvsOO6Vsz4_0oDwlCqcTW32j.exe"C:\Users\Admin\Pictures\Adobe Films\DvsOO6Vsz4_0oDwlCqcTW32j.exe"5⤵PID:1236
-
-
C:\Users\Admin\Pictures\Adobe Films\hw_CQIUhi2y1qedbio3NhdjI.exe"C:\Users\Admin\Pictures\Adobe Films\hw_CQIUhi2y1qedbio3NhdjI.exe"5⤵PID:2144
-
-
C:\Users\Admin\Pictures\Adobe Films\uHGIdB8xHPfycCRsNahwJCOm.exe"C:\Users\Admin\Pictures\Adobe Films\uHGIdB8xHPfycCRsNahwJCOm.exe"5⤵PID:3068
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue094093eaba3241.exe3⤵
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue094093eaba3241.exeTue094093eaba3241.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0920739b1b1367340.exe3⤵
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue0920739b1b1367340.exeTue0920739b1b1367340.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
PID:1064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1064 -s 9765⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue094bcd3f59.exe3⤵
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue094bcd3f59.exeTue094bcd3f59.exe4⤵
- Executes dropped EXE
PID:1444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue09d48d6e278d9ad1.exe3⤵
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue09d48d6e278d9ad1.exeTue09d48d6e278d9ad1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1724 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵PID:1796
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Vai.pdf5⤵PID:1640
-
C:\Windows\SysWOW64\cmd.execmd6⤵
- Loads dropped DLL
PID:1200 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mtHoKMPFYDHibgXoaLvAaWsXCpDWIDAtGvzDsjSTgLhRLduwJPppYNJDMJFBoSWxeCBqVxQuTCkHIAkke$" Dal.pdf7⤵PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.comVolevo.exe.com H7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:852 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.com H8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2044
-
-
-
C:\Windows\SysWOW64\PING.EXEping EDWYFHKN -n 307⤵
- Runs ping.exe
PID:1076
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue095a91fcf60e296.exe3⤵
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue095a91fcf60e296.exeTue095a91fcf60e296.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue098c67724cc.exe3⤵
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\7zSC43C16A5\Tue098c67724cc.exeTue098c67724cc.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 4363⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-