redline | b10274561191cedb0b16d2a69fdcd4e5062edfe2621842eacd55945ffded3f57

Analysis

max time kernel
46s
max time network
154s
platform
windows10_x64
resource
win10-en-20211104
submitted
26/11/2021, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
Size 3.6MB
Sample211126-txhpqaddgr
SHA256 b10274561191cedb0b16d2a69fdcd4e5062edfe2621842eacd55945ffded3f57
MD5 19008dabdac3c666e9006648027c4754
SHA1 6a054be41ac9a5badab8d38552b8703c12b33cca
SHA512 83ff9b3b897055039061abcf65f46cfb2dbe8c418c4f959a2727f49035a361f541a1e2f511463cbd7449d0cb4828b6ae66290e1a6ed917d1b0d408d4bd90450b
MD5 SHA1 SHA512

Score

10^/10

redline socelars vidar 706 pab777 aspackv2 infostealer spyware stealer suricata

Malware Config

Extracted

Family

vidar

Version

40.2

Botnet

https://kipriauka.tumblr.com/

Attributes

profile_id
706

Extracted

Family

redline

Botnet

pab777

185.215.113.15:6043

Extracted

Family

socelars

http://www.ecgbg.com/

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral2/memory/4044-238-0x0000000003AF0000-0x0000000003B0F000-memory.dmp	family_redline
behavioral2/memory/4044-244-0x0000000003C50000-0x0000000003C6E000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000400000001abf9-522.dat	family_socelars
behavioral2/files/0x000400000001abf9-523.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3880 created 516	3880	WerFault.exe	87

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/516-218-0x0000000000B20000-0x0000000000BF3000-memory.dmp	family_vidar
behavioral2/memory/516-220-0x0000000000400000-0x0000000000595000-memory.dmp	family_vidar

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001ab85-125.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab85-122.dat	aspack_v212_v242
behavioral2/files/0x000400000001ab8d-128.dat	aspack_v212_v242
behavioral2/files/0x000400000001ab8d-129.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab84-123.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab84-130.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab84-131.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
2148	setup_install.exe
1480	Tue0699904d3988.exe
2788	Tue06fef1eb6915a54.exe
396	Tue06481b746d289c.exe
1148	Tue06a05305b6ee3.exe
4044	Tue062aa86676e1a963.exe
3116	Tue06490e70c2.exe
516	Tue0634f55dcf1.exe
976	Tue0676b4d32ba71a3.exe
940	Tue0631100942b.exe
2184	Tue06fef1eb6915a54.exe
2876	Tue06a05305b6ee3.tmp

Loads dropped DLL 7 IoCs

pid	Process
2148	setup_install.exe
2148	setup_install.exe
2148	setup_install.exe
2148	setup_install.exe
2148	setup_install.exe
2148	setup_install.exe
2876	Tue06a05305b6ee3.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ip-api.com
97	ipinfo.io
98	ipinfo.io

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1884	2148	WerFault.exe	69
3880	516	WerFault.exe	87

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Tue0634f55dcf1.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Tue0634f55dcf1.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1272	powershell.exe
1884	WerFault.exe
1884	WerFault.exe
1272	powershell.exe
1272	powershell.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe
3880	WerFault.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	Tue06490e70c2.exe
Token: SeDebugPrivilege	396	Tue06481b746d289c.exe
Token: SeRestorePrivilege	1884	WerFault.exe
Token: SeBackupPrivilege	1884	WerFault.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1884	WerFault.exe
Token: SeDebugPrivilege	940	Tue0631100942b.exe
Token: SeDebugPrivilege	3880	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2148	2844	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	69
PID 2844 wrote to memory of 2148	2844	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	69
PID 2844 wrote to memory of 2148	2844	B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe	69
PID 2148 wrote to memory of 656	2148	setup_install.exe	72
PID 2148 wrote to memory of 656	2148	setup_install.exe	72
PID 2148 wrote to memory of 656	2148	setup_install.exe	72
PID 2148 wrote to memory of 860	2148	setup_install.exe	73
PID 2148 wrote to memory of 860	2148	setup_install.exe	73
PID 2148 wrote to memory of 860	2148	setup_install.exe	73
PID 2148 wrote to memory of 1056	2148	setup_install.exe	74
PID 2148 wrote to memory of 1056	2148	setup_install.exe	74
PID 2148 wrote to memory of 1056	2148	setup_install.exe	74
PID 2148 wrote to memory of 3976	2148	setup_install.exe	75
PID 2148 wrote to memory of 3976	2148	setup_install.exe	75
PID 2148 wrote to memory of 3976	2148	setup_install.exe	75
PID 2148 wrote to memory of 3968	2148	setup_install.exe	96
PID 2148 wrote to memory of 3968	2148	setup_install.exe	96
PID 2148 wrote to memory of 3968	2148	setup_install.exe	96
PID 2148 wrote to memory of 3436	2148	setup_install.exe	95
PID 2148 wrote to memory of 3436	2148	setup_install.exe	95
PID 2148 wrote to memory of 3436	2148	setup_install.exe	95
PID 2148 wrote to memory of 2208	2148	setup_install.exe	94
PID 2148 wrote to memory of 2208	2148	setup_install.exe	94
PID 2148 wrote to memory of 2208	2148	setup_install.exe	94
PID 2148 wrote to memory of 1012	2148	setup_install.exe	76
PID 2148 wrote to memory of 1012	2148	setup_install.exe	76
PID 2148 wrote to memory of 1012	2148	setup_install.exe	76
PID 3976 wrote to memory of 1480	3976	cmd.exe	93
PID 3976 wrote to memory of 1480	3976	cmd.exe	93
PID 860 wrote to memory of 2788	860	cmd.exe	92
PID 860 wrote to memory of 2788	860	cmd.exe	92
PID 860 wrote to memory of 2788	860	cmd.exe	92
PID 2148 wrote to memory of 1628	2148	setup_install.exe	91
PID 2148 wrote to memory of 1628	2148	setup_install.exe	91
PID 2148 wrote to memory of 1628	2148	setup_install.exe	91
PID 2148 wrote to memory of 1472	2148	setup_install.exe	90
PID 2148 wrote to memory of 1472	2148	setup_install.exe	90
PID 2148 wrote to memory of 1472	2148	setup_install.exe	90
PID 1012 wrote to memory of 396	1012	cmd.exe	77
PID 1012 wrote to memory of 396	1012	cmd.exe	77
PID 3436 wrote to memory of 1148	3436	cmd.exe	78
PID 3436 wrote to memory of 1148	3436	cmd.exe	78
PID 3436 wrote to memory of 1148	3436	cmd.exe	78
PID 1628 wrote to memory of 4044	1628	cmd.exe	89
PID 1628 wrote to memory of 4044	1628	cmd.exe	89
PID 1628 wrote to memory of 4044	1628	cmd.exe	89
PID 1472 wrote to memory of 3116	1472	cmd.exe	88
PID 1472 wrote to memory of 3116	1472	cmd.exe	88
PID 3968 wrote to memory of 516	3968	cmd.exe	87
PID 3968 wrote to memory of 516	3968	cmd.exe	87
PID 3968 wrote to memory of 516	3968	cmd.exe	87
PID 656 wrote to memory of 1272	656	cmd.exe	86
PID 656 wrote to memory of 1272	656	cmd.exe	86
PID 656 wrote to memory of 1272	656	cmd.exe	86
PID 1056 wrote to memory of 940	1056	cmd.exe	85
PID 1056 wrote to memory of 940	1056	cmd.exe	85
PID 2208 wrote to memory of 976	2208	cmd.exe	84
PID 2208 wrote to memory of 976	2208	cmd.exe	84
PID 2208 wrote to memory of 976	2208	cmd.exe	84
PID 2788 wrote to memory of 2184	2788	Tue06fef1eb6915a54.exe	80
PID 2788 wrote to memory of 2184	2788	Tue06fef1eb6915a54.exe	80
PID 2788 wrote to memory of 2184	2788	Tue06fef1eb6915a54.exe	80
PID 1148 wrote to memory of 2876	1148	Tue06a05305b6ee3.exe	82
PID 1148 wrote to memory of 2876	1148	Tue06a05305b6ee3.exe	82

C:\Users\Admin\AppData\Local\Temp\B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe
"C:\Users\Admin\AppData\Local\Temp\B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:656
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06fef1eb6915a54.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06fef1eb6915a54.exe
      Tue06fef1eb6915a54.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0631100942b.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue0631100942b.exe
      Tue0631100942b.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0699904d3988.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue0699904d3988.exe
      Tue0699904d3988.exe
      4⤵
      Executes dropped EXE
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06481b746d289c.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06481b746d289c.exe
      Tue06481b746d289c.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 560
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06490e70c2.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue062aa86676e1a963.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0676b4d32ba71a3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue06a05305b6ee3.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0634f55dcf1.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3968

C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06a05305b6ee3.exe
Tue06a05305b6ee3.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Local\Temp\is-BI4H1.tmp\Tue06a05305b6ee3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BI4H1.tmp\Tue06a05305b6ee3.tmp" /SL5="$40124,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06a05305b6ee3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2876

C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06fef1eb6915a54.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06fef1eb6915a54.exe" -u
1⤵
- Executes dropped EXE
PID:2184

C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue0676b4d32ba71a3.exe
Tue0676b4d32ba71a3.exe
1⤵
- Executes dropped EXE
PID:976
- C:\Users\Admin\Pictures\Adobe Films\AaBsg1p6RLaquhNEMfmTc2wc.exe
  "C:\Users\Admin\Pictures\Adobe Films\AaBsg1p6RLaquhNEMfmTc2wc.exe"
  2⤵
  PID:3696
- C:\Users\Admin\Pictures\Adobe Films\OCf7yiqhoXTjgsw1XEgJmeVC.exe
  "C:\Users\Admin\Pictures\Adobe Films\OCf7yiqhoXTjgsw1XEgJmeVC.exe"
  2⤵
  PID:2284
- C:\Users\Admin\Pictures\Adobe Films\TXtbqPsPfwsnxY8lljvdzoAw.exe
  "C:\Users\Admin\Pictures\Adobe Films\TXtbqPsPfwsnxY8lljvdzoAw.exe"
  2⤵
  PID:708
- C:\Users\Admin\Pictures\Adobe Films\sKRR3SV_KwiDAT3bIRpji7uj.exe
  "C:\Users\Admin\Pictures\Adobe Films\sKRR3SV_KwiDAT3bIRpji7uj.exe"
  2⤵
  PID:588
- C:\Users\Admin\Pictures\Adobe Films\KMvH_AfMHqrfLHmZwRHFXK2r.exe
  "C:\Users\Admin\Pictures\Adobe Films\KMvH_AfMHqrfLHmZwRHFXK2r.exe"
  2⤵
  PID:1292
- C:\Users\Admin\Pictures\Adobe Films\ixR_NqKlH7pNs45fa6UA5Iup.exe
  "C:\Users\Admin\Pictures\Adobe Films\ixR_NqKlH7pNs45fa6UA5Iup.exe"
  2⤵
  PID:3444
- C:\Users\Admin\Pictures\Adobe Films\Tg5VaVf0bFjgjrKEPvS23oTy.exe
  "C:\Users\Admin\Pictures\Adobe Films\Tg5VaVf0bFjgjrKEPvS23oTy.exe"
  2⤵
  PID:1272
- C:\Users\Admin\Pictures\Adobe Films\eCT01TZA_Ue4PvJyNqdzHgA8.exe
  "C:\Users\Admin\Pictures\Adobe Films\eCT01TZA_Ue4PvJyNqdzHgA8.exe"
  2⤵
  PID:3032
- C:\Users\Admin\Pictures\Adobe Films\DGtN45dTPTdzIsBNKyX7fByM.exe
  "C:\Users\Admin\Pictures\Adobe Films\DGtN45dTPTdzIsBNKyX7fByM.exe"
  2⤵
  PID:1108
- C:\Users\Admin\Pictures\Adobe Films\EdztRYCCOJQ4yja4Qcg9OofP.exe
  "C:\Users\Admin\Pictures\Adobe Films\EdztRYCCOJQ4yja4Qcg9OofP.exe"
  2⤵
  PID:1036
- C:\Users\Admin\Pictures\Adobe Films\61MTtgmr9esp6NWIMjJ_5bcx.exe
  "C:\Users\Admin\Pictures\Adobe Films\61MTtgmr9esp6NWIMjJ_5bcx.exe"
  2⤵
  PID:3888
- C:\Users\Admin\Pictures\Adobe Films\OQGiP6aBsREnSegp2pYNSBti.exe
  "C:\Users\Admin\Pictures\Adobe Films\OQGiP6aBsREnSegp2pYNSBti.exe"
  2⤵
  PID:3684
- C:\Users\Admin\Pictures\Adobe Films\oLKsbz7erX4tUXy6UT3j1AOI.exe
  "C:\Users\Admin\Pictures\Adobe Films\oLKsbz7erX4tUXy6UT3j1AOI.exe"
  2⤵
  PID:2856
- C:\Users\Admin\Pictures\Adobe Films\vJa088um9Yybrm3ZaATC9RgQ.exe
  "C:\Users\Admin\Pictures\Adobe Films\vJa088um9Yybrm3ZaATC9RgQ.exe"
  2⤵
  PID:2268
- C:\Users\Admin\Pictures\Adobe Films\I88N3R1YjUqaSxKHWPHF3UtC.exe
  "C:\Users\Admin\Pictures\Adobe Films\I88N3R1YjUqaSxKHWPHF3UtC.exe"
  2⤵
  PID:3508
- C:\Users\Admin\Pictures\Adobe Films\smDtMkv2qPC0f_zTiN3MUgH5.exe
  "C:\Users\Admin\Pictures\Adobe Films\smDtMkv2qPC0f_zTiN3MUgH5.exe"
  2⤵
  PID:1112
- C:\Users\Admin\Pictures\Adobe Films\TmDA0PBUpKuCX3e0ZIz0Mz0B.exe
  "C:\Users\Admin\Pictures\Adobe Films\TmDA0PBUpKuCX3e0ZIz0Mz0B.exe"
  2⤵
  PID:2848
- C:\Users\Admin\Pictures\Adobe Films\Tx3P5jqy2ICD5_mzdm6xN6Xi.exe
  "C:\Users\Admin\Pictures\Adobe Films\Tx3P5jqy2ICD5_mzdm6xN6Xi.exe"
  2⤵
  PID:3800
- C:\Users\Admin\Pictures\Adobe Films\LpdIV7JvYfl_siAFkVjmmTN0.exe
  "C:\Users\Admin\Pictures\Adobe Films\LpdIV7JvYfl_siAFkVjmmTN0.exe"
  2⤵
  PID:4200
- C:\Users\Admin\Pictures\Adobe Films\9nwIv6Vr50zNVjqml1byAmjB.exe
  "C:\Users\Admin\Pictures\Adobe Films\9nwIv6Vr50zNVjqml1byAmjB.exe"
  2⤵
  PID:4184
- C:\Users\Admin\Pictures\Adobe Films\8rgaMT91qk0LF9aaXxdmzXRv.exe
  "C:\Users\Admin\Pictures\Adobe Films\8rgaMT91qk0LF9aaXxdmzXRv.exe"
  2⤵
  PID:4172
- C:\Users\Admin\Pictures\Adobe Films\RJ1x8rexSJ9hKinyZaMrxOQr.exe
  "C:\Users\Admin\Pictures\Adobe Films\RJ1x8rexSJ9hKinyZaMrxOQr.exe"
  2⤵
  PID:4452
- C:\Users\Admin\Pictures\Adobe Films\eX4FdPhTYYUDi9XdMOhei0DM.exe
  "C:\Users\Admin\Pictures\Adobe Films\eX4FdPhTYYUDi9XdMOhei0DM.exe"
  2⤵
  PID:4428
- C:\Users\Admin\Pictures\Adobe Films\p50YktheVMGtra7xfxfyKykF.exe
  "C:\Users\Admin\Pictures\Adobe Films\p50YktheVMGtra7xfxfyKykF.exe"
  2⤵
  PID:4436
- C:\Users\Admin\Pictures\Adobe Films\19xWN3rLqBi1r3jMGYfr72ov.exe
  "C:\Users\Admin\Pictures\Adobe Films\19xWN3rLqBi1r3jMGYfr72ov.exe"
  2⤵
  PID:4412
- C:\Users\Admin\Pictures\Adobe Films\BfpNXkqhrtsSvj3QjBgCborH.exe
  "C:\Users\Admin\Pictures\Adobe Films\BfpNXkqhrtsSvj3QjBgCborH.exe"
  2⤵
  PID:4404
- C:\Users\Admin\Pictures\Adobe Films\pSQPzN_Au9381acb5ui_NNiI.exe
  "C:\Users\Admin\Pictures\Adobe Films\pSQPzN_Au9381acb5ui_NNiI.exe"
  2⤵
  PID:4368
- C:\Users\Admin\Pictures\Adobe Films\snwAx4piWhWLHk5B18xK_8e1.exe
  "C:\Users\Admin\Pictures\Adobe Films\snwAx4piWhWLHk5B18xK_8e1.exe"
  2⤵
  PID:4320
- C:\Users\Admin\Pictures\Adobe Films\hDNKbSa7kiEzLCN4QcIuGqXH.exe
  "C:\Users\Admin\Pictures\Adobe Films\hDNKbSa7kiEzLCN4QcIuGqXH.exe"
  2⤵
  PID:4232

C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue0634f55dcf1.exe
Tue0634f55dcf1.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 1492
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3880

C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue06490e70c2.exe
Tue06490e70c2.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Users\Admin\AppData\Local\Temp\7zSC1BE80B5\Tue062aa86676e1a963.exe
Tue062aa86676e1a963.exe
1⤵
- Executes dropped EXE
PID:4044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/396-205-0x0000000002AB0000-0x0000000002AB2000-memory.dmp

Download

memory/396-192-0x00000000010A0000-0x00000000010B6000-memory.dmp

Download

memory/396-171-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/516-220-0x0000000000400000-0x0000000000595000-memory.dmp

Download

memory/516-218-0x0000000000B20000-0x0000000000BF3000-memory.dmp

Download

memory/708-542-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/708-529-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/708-545-0x0000000003590000-0x0000000003591000-memory.dmp

Download

memory/940-214-0x000002858A535000-0x000002858A537000-memory.dmp

Download

memory/940-212-0x000002858A534000-0x000002858A535000-memory.dmp

Download

memory/940-209-0x00000285A74F0000-0x00000285A756E000-memory.dmp

Download

memory/940-207-0x000002858A530000-0x000002858A532000-memory.dmp

Download

memory/940-213-0x000002858A532000-0x000002858A534000-memory.dmp

Download

memory/940-190-0x0000028589F20000-0x0000028589F21000-memory.dmp

Download

memory/940-199-0x000002858A540000-0x000002858A54B000-memory.dmp

Download

memory/976-485-0x00000000037E0000-0x000000000392C000-memory.dmp

Download

memory/1036-510-0x00000000008D0000-0x0000000000A1A000-memory.dmp

Download

memory/1108-534-0x0000000000400000-0x00000000004E0000-memory.dmp

Download

memory/1148-198-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1272-203-0x0000000006D70000-0x0000000006D71000-memory.dmp

Download

memory/1272-223-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/1272-230-0x0000000008A10000-0x0000000008A43000-memory.dmp

Download

memory/1272-237-0x00000000089F0000-0x00000000089F1000-memory.dmp

Download

memory/1272-222-0x0000000007C60000-0x0000000007C61000-memory.dmp

Download

memory/1272-200-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/1272-204-0x00000000011F2000-0x00000000011F3000-memory.dmp

Download

memory/1272-245-0x0000000008B60000-0x0000000008B61000-memory.dmp

Download

memory/1272-206-0x00000000011F0000-0x00000000011F1000-memory.dmp

Download

memory/1272-194-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/1272-191-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/1272-249-0x0000000008F40000-0x0000000008F41000-memory.dmp

Download

memory/1272-210-0x0000000006BB0000-0x0000000006BB1000-memory.dmp

Download

memory/1272-251-0x000000007E540000-0x000000007E541000-memory.dmp

Download

memory/1272-215-0x0000000006C50000-0x0000000006C51000-memory.dmp

Download

memory/1272-216-0x0000000007510000-0x0000000007511000-memory.dmp

Download

memory/1272-217-0x0000000007580000-0x0000000007581000-memory.dmp

Download

memory/1272-257-0x00000000011F3000-0x00000000011F4000-memory.dmp

Download

memory/1272-221-0x0000000007DA0000-0x0000000007DA1000-memory.dmp

Download

memory/1272-219-0x0000000006D50000-0x0000000006D51000-memory.dmp

Download

memory/2148-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2148-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2148-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2148-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2148-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/2148-159-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2148-167-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2148-139-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/2148-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2148-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/2148-161-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2148-166-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/2876-211-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/3116-201-0x0000000001370000-0x0000000001372000-memory.dmp

Download

memory/3116-182-0x0000000000C60000-0x0000000000C61000-memory.dmp

Download

memory/4044-252-0x0000000000400000-0x0000000001D9A000-memory.dmp

Download

memory/4044-240-0x0000000006610000-0x0000000006611000-memory.dmp

Download

memory/4044-244-0x0000000003C50000-0x0000000003C6E000-memory.dmp

Download

memory/4044-246-0x0000000006B10000-0x0000000006B11000-memory.dmp

Download

memory/4044-247-0x0000000003D00000-0x0000000003D01000-memory.dmp

Download

memory/4044-248-0x0000000006430000-0x0000000006431000-memory.dmp

Download

memory/4044-181-0x0000000001EC7000-0x0000000001EEA000-memory.dmp

Download

memory/4044-250-0x0000000001E20000-0x0000000001ECE000-memory.dmp

Download

memory/4044-238-0x0000000003AF0000-0x0000000003B0F000-memory.dmp

Download

memory/4044-253-0x0000000006600000-0x0000000006601000-memory.dmp

Download

memory/4044-304-0x0000000006604000-0x0000000006606000-memory.dmp

Download

memory/4044-255-0x0000000006603000-0x0000000006604000-memory.dmp

Download

memory/4044-254-0x0000000006602000-0x0000000006603000-memory.dmp

Download