Analysis

  • max time kernel
    61s
  • max time network
    160s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    20/12/2021, 14:02

General

  • Target

    fd2464429aae52de3c9cdc5f1d5346900eef4aa30a2311f7350190b7a7bdac4a.exe

  • Size

    7.3MB

  • MD5

    37ff68170c14560d4375f56eecd52fed

  • SHA1

    4f7dad85d8eebb8d3131a661c17e1b34082d852f

  • SHA256

    fd2464429aae52de3c9cdc5f1d5346900eef4aa30a2311f7350190b7a7bdac4a

  • SHA512

    d41bf88bfb1ea7f7a063e73fcb9ee4e886b1cd63cb1daced065c9e086d590f9cc527384cc65fac0fb4a6e91858aafc0b10a3ba1200b972bbfe5035aede213ac0

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

raccoon

Botnet

b2a6680a55967ecaa6997d8e44705c8be49a632c

Attributes
  • url4cnc

    http://194.180.174.53/masseffectus2

    http://91.219.236.18/masseffectus2

    http://194.180.174.41/masseffectus2

    http://91.219.236.148/masseffectus2

    https://t.me/masseffectus2

rc4.plain
rc4.plain

Extracted

Family

vidar

Version

49.1

Botnet

915

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies registry class 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd2464429aae52de3c9cdc5f1d5346900eef4aa30a2311f7350190b7a7bdac4a.exe
    "C:\Users\Admin\AppData\Local\Temp\fd2464429aae52de3c9cdc5f1d5346900eef4aa30a2311f7350190b7a7bdac4a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC839B316\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:644
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:1340
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1984
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
              PID:64
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1512
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sat22af478322381d366.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:884
              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22af478322381d366.exe
                Sat22af478322381d366.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:3008
                • C:\Users\Admin\AppData\Local\8998eafc-24a7-4739-a6fe-52d22e7dc851.exe
                  "C:\Users\Admin\AppData\Local\8998eafc-24a7-4739-a6fe-52d22e7dc851.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:992
                • C:\Users\Admin\AppData\Local\da8e7a3c-d4d3-4fd0-85c2-2fd20ccd124c.exe
                  "C:\Users\Admin\AppData\Local\da8e7a3c-d4d3-4fd0-85c2-2fd20ccd124c.exe"
                  6⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:1264
                  • C:\Users\Admin\AppData\Roaming\79437124\4355645643556456.exe
                    "C:\Users\Admin\AppData\Roaming\79437124\4355645643556456.exe"
                    7⤵
                    • Executes dropped EXE
                    PID:4388
                • C:\Users\Admin\AppData\Local\cec7e9bb-42cb-4624-b546-1cc9168b86e0.exe
                  "C:\Users\Admin\AppData\Local\cec7e9bb-42cb-4624-b546-1cc9168b86e0.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3724
                • C:\Users\Admin\AppData\Local\544caec6-7be1-4a6a-b582-89095b0473e8.exe
                  "C:\Users\Admin\AppData\Local\544caec6-7be1-4a6a-b582-89095b0473e8.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4168
                • C:\Users\Admin\AppData\Local\67bd8fba-bb57-489e-81a9-5c61a8275ffe.exe
                  "C:\Users\Admin\AppData\Local\67bd8fba-bb57-489e-81a9-5c61a8275ffe.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4208
                  • C:\Users\Admin\AppData\Roaming\5417490.exe
                    "C:\Users\Admin\AppData\Roaming\5417490.exe"
                    7⤵
                      PID:5004
                      • C:\Windows\SysWOW64\control.exe
                        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\5wSR6.cPL",
                        8⤵
                          PID:4348
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5wSR6.cPL",
                            9⤵
                              PID:4584
                              • C:\Windows\system32\RunDll32.exe
                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\5wSR6.cPL",
                                10⤵
                                  PID:3476
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\5wSR6.cPL",
                                    11⤵
                                      PID:2876
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Sat22c6ea1853d48f.exe
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:60
                        • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22c6ea1853d48f.exe
                          Sat22c6ea1853d48f.exe
                          5⤵
                          • Executes dropped EXE
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:1500
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Sat22e7bb82f1.exe
                        4⤵
                          PID:2408
                          • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22e7bb82f1.exe
                            Sat22e7bb82f1.exe
                            5⤵
                            • Executes dropped EXE
                            PID:816
                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              6⤵
                              • Executes dropped EXE
                              PID:512
                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                              C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              6⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2092
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Sat2222ad87648d7d9f.exe
                          4⤵
                            PID:3076
                            • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2222ad87648d7d9f.exe
                              Sat2222ad87648d7d9f.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4080
                              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2222ad87648d7d9f.exe
                                C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2222ad87648d7d9f.exe
                                6⤵
                                  PID:4604
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat22cc079fa975742.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2600
                              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22cc079fa975742.exe
                                Sat22cc079fa975742.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1216
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Sat22a4f1998457e.exe
                              4⤵
                                PID:1040
                                • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22a4f1998457e.exe
                                  Sat22a4f1998457e.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2036
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    6⤵
                                      PID:4668
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        7⤵
                                        • Kills process with taskkill
                                        PID:4976
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Sat2283621daf918e8.exe
                                  4⤵
                                    PID:560
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2283621daf918e8.exe
                                      Sat2283621daf918e8.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2144
                                      • C:\Users\Admin\AppData\Local\Temp\is-K9NH3.tmp\Sat2283621daf918e8.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-K9NH3.tmp\Sat2283621daf918e8.tmp" /SL5="$20144,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2283621daf918e8.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:728
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Sat2266f583ece132764.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:648
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2266f583ece132764.exe
                                      Sat2266f583ece132764.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:1228
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Sat22b701d5ae327922.exe
                                    4⤵
                                      PID:936
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22b701d5ae327922.exe
                                        Sat22b701d5ae327922.exe
                                        5⤵
                                        • Executes dropped EXE
                                        PID:824
                                        • C:\Windows\SysWOW64\control.exe
                                          "C:\Windows\System32\control.exe" .\T2bGV.~
                                          6⤵
                                            PID:1824
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\T2bGV.~
                                              7⤵
                                              • Loads dropped DLL
                                              PID:1444
                                              • C:\Windows\system32\RunDll32.exe
                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\T2bGV.~
                                                8⤵
                                                  PID:4672
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\T2bGV.~
                                                    9⤵
                                                      PID:3744
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Sat22a5cbbcf173835.exe
                                            4⤵
                                              PID:2300
                                              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat22a5cbbcf173835.exe
                                                Sat22a5cbbcf173835.exe
                                                5⤵
                                                • Executes dropped EXE
                                                PID:1632
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Sat220bfcb617d56673.exe
                                              4⤵
                                                PID:2984
                                                • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat220bfcb617d56673.exe
                                                  Sat220bfcb617d56673.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:1140
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im Sat220bfcb617d56673.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat220bfcb617d56673.exe" & del C:\ProgramData\*.dll & exit
                                                    6⤵
                                                      PID:5036
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /im Sat220bfcb617d56673.exe /f
                                                        7⤵
                                                        • Kills process with taskkill
                                                        PID:2032
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 6
                                                        7⤵
                                                        • Delays execution with timeout.exe
                                                        PID:4732
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Sat229e7cb41de510.exe
                                                  4⤵
                                                    PID:3024
                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat229e7cb41de510.exe
                                                      Sat229e7cb41de510.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      PID:3096
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat229e7cb41de510.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat229e7cb41de510.exe" -u
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:1496
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Sat221b5ce8aed21c76.exe
                                                    4⤵
                                                      PID:1332
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat221b5ce8aed21c76.exe
                                                        Sat221b5ce8aed21c76.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:1212
                                                        • C:\Windows\SysWOW64\control.exe
                                                          "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\_DNp8YI.cpL",
                                                          6⤵
                                                            PID:752
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\_DNp8YI.cpL",
                                                              7⤵
                                                              • Loads dropped DLL
                                                              PID:3960
                                                              • C:\Windows\system32\RunDll32.exe
                                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\_DNp8YI.cpL",
                                                                8⤵
                                                                  PID:5112
                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\_DNp8YI.cpL",
                                                                    9⤵
                                                                      PID:4384
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Sat2296fa05ad3b7a5.exe /mixtwo
                                                            4⤵
                                                              PID:3608
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c Sat221c9edb4c2b0b99e.exe
                                                              4⤵
                                                                PID:3656
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Sat2200e2983a9ef.exe
                                                                4⤵
                                                                  PID:1896
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2200e2983a9ef.exe
                                                            Sat2200e2983a9ef.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2104
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2200e2983a9ef.exe
                                                              C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2200e2983a9ef.exe
                                                              2⤵
                                                                PID:4588
                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2296fa05ad3b7a5.exe
                                                              Sat2296fa05ad3b7a5.exe /mixtwo
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:3840
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2296fa05ad3b7a5.exe
                                                                Sat2296fa05ad3b7a5.exe /mixtwo
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:1100
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "Sat2296fa05ad3b7a5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2296fa05ad3b7a5.exe" & exit
                                                                  3⤵
                                                                    PID:2220
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /im "Sat2296fa05ad3b7a5.exe" /f
                                                                      4⤵
                                                                      • Kills process with taskkill
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1292
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat221c9edb4c2b0b99e.exe
                                                                Sat221c9edb4c2b0b99e.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:3724
                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2283621daf918e8.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2283621daf918e8.exe" /SILENT
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:3732
                                                                • C:\Users\Admin\AppData\Local\Temp\is-THNEF.tmp\Sat2283621daf918e8.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-THNEF.tmp\Sat2283621daf918e8.tmp" /SL5="$30144,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC839B316\Sat2283621daf918e8.exe" /SILENT
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:396
                                                              • C:\Windows\system32\rundll32.exe
                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                1⤵
                                                                • Process spawned unexpected child process
                                                                PID:5024
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                  2⤵
                                                                    PID:5052
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                  1⤵
                                                                    PID:2956

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • memory/344-427-0x000001E4C5040000-0x000001E4C50B2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/344-498-0x000001E4C5110000-0x000001E4C5182000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/396-272-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/512-266-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                          Filesize

                                                                          340KB

                                                                        • memory/644-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                          Filesize

                                                                          572KB

                                                                        • memory/644-132-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/644-131-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/644-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/644-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/644-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                          Filesize

                                                                          572KB

                                                                        • memory/644-137-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                          Filesize

                                                                          572KB

                                                                        • memory/644-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/644-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/644-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/644-141-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/644-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                          Filesize

                                                                          152KB

                                                                        • memory/728-251-0x0000000000C30000-0x0000000000C31000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/824-204-0x0000000000610000-0x0000000000611000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/824-202-0x0000000000610000-0x0000000000611000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/944-445-0x000001480BF70000-0x000001480BFE2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/944-505-0x000001480C640000-0x000001480C6B2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/992-306-0x0000000000C20000-0x0000000000C21000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/992-296-0x0000000000390000-0x0000000000391000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/992-324-0x0000000000C40000-0x0000000000C41000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/992-339-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/992-316-0x0000000004BD0000-0x0000000004C30000-memory.dmp

                                                                          Filesize

                                                                          384KB

                                                                        • memory/1080-500-0x000001D110360000-0x000001D1103D2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1080-443-0x000001D110270000-0x000001D1102E2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1100-239-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                          Filesize

                                                                          320KB

                                                                        • memory/1100-226-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                          Filesize

                                                                          320KB

                                                                        • memory/1140-281-0x0000000002010000-0x00000000020E9000-memory.dmp

                                                                          Filesize

                                                                          868KB

                                                                        • memory/1140-274-0x0000000000916000-0x0000000000992000-memory.dmp

                                                                          Filesize

                                                                          496KB

                                                                        • memory/1140-286-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                          Filesize

                                                                          1.2MB

                                                                        • memory/1192-508-0x000001AC60AC0000-0x000001AC60B32000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1192-455-0x000001AC60A40000-0x000001AC60AB2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1212-214-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1212-217-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1216-215-0x000000001BA90000-0x000000001BA92000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1216-174-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1264-293-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1264-307-0x00000000008A0000-0x00000000008A1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1264-301-0x0000000000800000-0x0000000000812000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                        • memory/1264-298-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1300-515-0x00000265A29A0000-0x00000265A2A12000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1300-456-0x00000265A2410000-0x00000265A2482000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1384-440-0x0000023C14E60000-0x0000023C14ED2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1384-507-0x0000023C15540000-0x0000023C155B2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1500-288-0x0000000000400000-0x00000000004C9000-memory.dmp

                                                                          Filesize

                                                                          804KB

                                                                        • memory/1500-285-0x00000000006A6000-0x00000000006B6000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/1500-287-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                                                          Filesize

                                                                          36KB

                                                                        • memory/1512-236-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1512-249-0x0000000006972000-0x0000000006973000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1512-318-0x00000000077C0000-0x00000000077C1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1512-245-0x0000000006970000-0x0000000006971000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1512-235-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1860-446-0x00000193AA920000-0x00000193AA992000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1860-509-0x00000193AAA20000-0x00000193AAA92000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/1984-244-0x0000000005120000-0x0000000005121000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1984-309-0x0000000007F10000-0x0000000007F11000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1984-240-0x0000000005130000-0x0000000005131000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1984-247-0x00000000077E0000-0x00000000077E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1984-230-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1984-248-0x0000000005122000-0x0000000005123000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1984-228-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2092-279-0x0000000000400000-0x000000000047C000-memory.dmp

                                                                          Filesize

                                                                          496KB

                                                                        • memory/2104-237-0x00000000009B0000-0x00000000009B1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2104-260-0x0000000002B50000-0x0000000002B51000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2104-259-0x00000000053E0000-0x00000000053E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2144-222-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                          Filesize

                                                                          816KB

                                                                        • memory/2344-497-0x000002087BBB0000-0x000002087BC22000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2344-441-0x000002087B160000-0x000002087B1D2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2380-501-0x0000028EAD210000-0x0000028EAD282000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2380-439-0x0000028EAD180000-0x0000028EAD1F2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2576-496-0x0000022530030000-0x00000225300A2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2576-426-0x000002252FC70000-0x000002252FCE2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2660-517-0x000001D4AF900000-0x000001D4AF972000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2660-457-0x000001D4AF540000-0x000001D4AF5B2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2672-458-0x000001685C570000-0x000001685C5E2000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/2956-428-0x00000202DE700000-0x00000202DE772000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/3008-192-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3008-243-0x00000000024F0000-0x00000000024F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3008-207-0x0000000000C00000-0x0000000000C01000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3008-219-0x000000001AFF0000-0x000000001AFF2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/3008-224-0x0000000000C10000-0x0000000000C24000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/3048-331-0x00000000015B0000-0x00000000015C6000-memory.dmp

                                                                          Filesize

                                                                          88KB

                                                                        • memory/3584-412-0x0000021D0B850000-0x0000021D0B89D000-memory.dmp

                                                                          Filesize

                                                                          308KB

                                                                        • memory/3584-413-0x0000021D0B910000-0x0000021D0B982000-memory.dmp

                                                                          Filesize

                                                                          456KB

                                                                        • memory/3724-315-0x0000000002910000-0x0000000002955000-memory.dmp

                                                                          Filesize

                                                                          276KB

                                                                        • memory/3724-367-0x00000000056C0000-0x00000000056C1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3724-310-0x0000000000BD0000-0x0000000000D9F000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/3724-311-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3724-308-0x0000000000BD0000-0x0000000000D9F000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/3732-267-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                          Filesize

                                                                          816KB

                                                                        • memory/4080-238-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4080-269-0x0000000004A90000-0x0000000004A91000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4080-258-0x0000000000B30000-0x0000000000B31000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4080-256-0x0000000004A80000-0x0000000004A81000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4080-254-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4168-327-0x0000000000F40000-0x0000000000F85000-memory.dmp

                                                                          Filesize

                                                                          276KB

                                                                        • memory/4168-322-0x0000000001320000-0x00000000014EF000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/4168-366-0x0000000004D60000-0x0000000004D61000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4168-321-0x0000000000120000-0x0000000000121000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4168-319-0x0000000001320000-0x00000000014EF000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/4208-348-0x0000000000C10000-0x0000000000C11000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4388-365-0x000000001B0A0000-0x000000001B0A2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/4584-472-0x000000002F6B0000-0x000000002F767000-memory.dmp

                                                                          Filesize

                                                                          732KB

                                                                        • memory/4584-465-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4584-473-0x000000002F830000-0x000000002F8E5000-memory.dmp

                                                                          Filesize

                                                                          724KB

                                                                        • memory/4588-390-0x00000000054B0000-0x0000000005AB6000-memory.dmp

                                                                          Filesize

                                                                          6.0MB

                                                                        • memory/4604-393-0x0000000005270000-0x0000000005876000-memory.dmp

                                                                          Filesize

                                                                          6.0MB

                                                                        • memory/5052-409-0x0000000004BB0000-0x0000000004C0D000-memory.dmp

                                                                          Filesize

                                                                          372KB

                                                                        • memory/5052-408-0x0000000004AAB000-0x0000000004BAC000-memory.dmp

                                                                          Filesize

                                                                          1.0MB