Analysis

  • max time kernel
    98s
  • max time network
    172s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23/12/2021, 13:28

General

  • Target

    fecd7bad63eecce136544e13015ac36b55d56ee6be14c9d01bcd75a118c759f1.exe

  • Size

    7.2MB

  • MD5

    8c58160ee123350f23b879bfc8493a4e

  • SHA1

    d37b113d7c41cff86f3b7b9caa8ec7a5d96cf19b

  • SHA256

    fecd7bad63eecce136544e13015ac36b55d56ee6be14c9d01bcd75a118c759f1

  • SHA512

    5c3e309a1d5820b5ee2f9aacd203c70e1cb3d6260f18ae61e22f6d507b23c43532064f4b4147bc59f56e2494ad11105b54617e505e591cefd6b226847a07f15f

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

userv1

C2

159.69.246.184:13127

Extracted

Family

redline

Botnet

media22ns

C2

65.108.69.168:13293

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
  • Modifies registry class 2 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fecd7bad63eecce136544e13015ac36b55d56ee6be14c9d01bcd75a118c759f1.exe
    "C:\Users\Admin\AppData\Local\Temp\fecd7bad63eecce136544e13015ac36b55d56ee6be14c9d01bcd75a118c759f1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS075D4006\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:644
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:1988
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2420
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
              PID:600
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3688
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu03812e8b6f95.exe
              4⤵
                PID:856
                • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03812e8b6f95.exe
                  Thu03812e8b6f95.exe
                  5⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  PID:1972
                  • C:\Windows\SysWOW64\control.exe
                    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\nmpadmoD.cPl",
                    6⤵
                      PID:1048
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\nmpadmoD.cPl",
                        7⤵
                        • Loads dropped DLL
                        PID:3840
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu038a24d798.exe
                  4⤵
                    PID:1736
                    • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu038a24d798.exe
                      Thu038a24d798.exe
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1952
                      • C:\Users\Admin\AppData\Local\ba5bd0de-1a31-4d32-9da7-a1f8016244dd.exe
                        "C:\Users\Admin\AppData\Local\ba5bd0de-1a31-4d32-9da7-a1f8016244dd.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:1056
                      • C:\Users\Admin\AppData\Local\d44de20a-aca5-4149-91b8-daf0c44fcad9.exe
                        "C:\Users\Admin\AppData\Local\d44de20a-aca5-4149-91b8-daf0c44fcad9.exe"
                        6⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:4004
                      • C:\Users\Admin\AppData\Local\85e9a6b6-1ed2-4524-b7f4-cd62e1b5c375.exe
                        "C:\Users\Admin\AppData\Local\85e9a6b6-1ed2-4524-b7f4-cd62e1b5c375.exe"
                        6⤵
                        • Executes dropped EXE
                        PID:4152
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Thu03b281c30a.exe
                    4⤵
                      PID:2064
                      • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03b281c30a.exe
                        Thu03b281c30a.exe
                        5⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1492
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          6⤵
                            PID:5076
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              7⤵
                              • Kills process with taskkill
                              PID:4676
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Thu03aa0b8bc75.exe
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1224
                        • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03aa0b8bc75.exe
                          Thu03aa0b8bc75.exe
                          5⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1676
                          • C:\Users\Admin\Pictures\Adobe Films\FIsnqqNlJ5Q7VkjaOYpTilgl.exe
                            "C:\Users\Admin\Pictures\Adobe Films\FIsnqqNlJ5Q7VkjaOYpTilgl.exe"
                            6⤵
                              PID:4600
                            • C:\Users\Admin\Pictures\Adobe Films\aGXQbiPH4VaCDX1f2_SZv0bN.exe
                              "C:\Users\Admin\Pictures\Adobe Films\aGXQbiPH4VaCDX1f2_SZv0bN.exe"
                              6⤵
                                PID:4216
                              • C:\Users\Admin\Pictures\Adobe Films\xbKAtG2MDXaEBqxkIS8AmIV3.exe
                                "C:\Users\Admin\Pictures\Adobe Films\xbKAtG2MDXaEBqxkIS8AmIV3.exe"
                                6⤵
                                  PID:4204
                                • C:\Users\Admin\Pictures\Adobe Films\ux75qkEoDOwuQPCim7uzNKLW.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\ux75qkEoDOwuQPCim7uzNKLW.exe"
                                  6⤵
                                    PID:4144
                                  • C:\Users\Admin\Pictures\Adobe Films\BVHf408jeqqDbZOsIH3lCc3v.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\BVHf408jeqqDbZOsIH3lCc3v.exe"
                                    6⤵
                                      PID:4120
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 400
                                        7⤵
                                        • Program crash
                                        PID:808
                                    • C:\Users\Admin\Pictures\Adobe Films\SVR0FOEfAavW5y5ABQ62QVQT.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\SVR0FOEfAavW5y5ABQ62QVQT.exe"
                                      6⤵
                                        PID:1392
                                      • C:\Users\Admin\Pictures\Adobe Films\9NEPaP_kmIgNvWi_liAOu2F4.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\9NEPaP_kmIgNvWi_liAOu2F4.exe"
                                        6⤵
                                          PID:5112
                                        • C:\Users\Admin\Pictures\Adobe Films\U1oLxP1dj18xns8npQsn_YbJ.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\U1oLxP1dj18xns8npQsn_YbJ.exe"
                                          6⤵
                                            PID:3156
                                          • C:\Users\Admin\Pictures\Adobe Films\ooR64eaw8Kse0tnEvTml85Ip.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\ooR64eaw8Kse0tnEvTml85Ip.exe"
                                            6⤵
                                              PID:1140
                                            • C:\Users\Admin\Pictures\Adobe Films\Rd31zGs3KnZU7xSvB3FRwMn4.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\Rd31zGs3KnZU7xSvB3FRwMn4.exe"
                                              6⤵
                                                PID:3592
                                              • C:\Users\Admin\Pictures\Adobe Films\GwfXPLvB2alEpCkwFiN8QVAi.exe
                                                "C:\Users\Admin\Pictures\Adobe Films\GwfXPLvB2alEpCkwFiN8QVAi.exe"
                                                6⤵
                                                  PID:2068
                                                • C:\Users\Admin\Pictures\Adobe Films\UNvGY0h0d2ah23qoBkBqCnvY.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\UNvGY0h0d2ah23qoBkBqCnvY.exe"
                                                  6⤵
                                                    PID:4996
                                                  • C:\Users\Admin\Pictures\Adobe Films\WFqrQz3DMhXwSudmsnHYSWkS.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\WFqrQz3DMhXwSudmsnHYSWkS.exe"
                                                    6⤵
                                                      PID:4816
                                                    • C:\Users\Admin\Pictures\Adobe Films\AgJDjk9Sm5nl9fo_4fS4yjfu.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\AgJDjk9Sm5nl9fo_4fS4yjfu.exe"
                                                      6⤵
                                                        PID:3868
                                                      • C:\Users\Admin\Pictures\Adobe Films\u9Am9do7BxsfBZY3gYl_cnCp.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\u9Am9do7BxsfBZY3gYl_cnCp.exe"
                                                        6⤵
                                                          PID:4984
                                                        • C:\Users\Admin\Pictures\Adobe Films\GbpxokxfED3PifOxDJI_kPXN.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\GbpxokxfED3PifOxDJI_kPXN.exe"
                                                          6⤵
                                                            PID:4968
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 776
                                                              7⤵
                                                              • Program crash
                                                              PID:4332
                                                          • C:\Users\Admin\Pictures\Adobe Films\nJOcL5aoQIceJ5kbcN3eRyq5.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\nJOcL5aoQIceJ5kbcN3eRyq5.exe"
                                                            6⤵
                                                              PID:68
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Thu03b32e8695.exe
                                                          4⤵
                                                            PID:3196
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03b32e8695.exe
                                                              Thu03b32e8695.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:2120
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Thu030f000c97b1a47cf.exe
                                                            4⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2284
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu030f000c97b1a47cf.exe
                                                              Thu030f000c97b1a47cf.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:1632
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Thu0340c0ac45a.exe
                                                            4⤵
                                                              PID:640
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0340c0ac45a.exe
                                                                Thu0340c0ac45a.exe
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:2144
                                                                • C:\Users\Admin\AppData\Local\Temp\is-C4MD5.tmp\Thu0340c0ac45a.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-C4MD5.tmp\Thu0340c0ac45a.tmp" /SL5="$6003A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0340c0ac45a.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:1512
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0340c0ac45a.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0340c0ac45a.exe" /SILENT
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:3172
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-H5S99.tmp\Thu0340c0ac45a.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-H5S99.tmp\Thu0340c0ac45a.tmp" /SL5="$501C8,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0340c0ac45a.exe" /SILENT
                                                                      8⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:3724
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-39J6J.tmp\windllhost.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-39J6J.tmp\windllhost.exe" 77
                                                                        9⤵
                                                                          PID:4544
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Thu03b1305321.exe
                                                                4⤵
                                                                  PID:2232
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03b1305321.exe
                                                                    Thu03b1305321.exe
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1892
                                                                    • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      PID:4320
                                                                      • C:\Users\Admin\AppData\Local\Temp\myamrnewfile.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\myamrnewfile.exe"
                                                                        7⤵
                                                                          PID:4656
                                                                        • C:\Users\Admin\AppData\Local\Temp\RobCleanerInstll31827.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\RobCleanerInstll31827.exe"
                                                                          7⤵
                                                                            PID:4728
                                                                          • C:\Users\Admin\AppData\Local\Temp\DisgruntleMezzanines_2021-12-22_21-08.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\DisgruntleMezzanines_2021-12-22_21-08.exe"
                                                                            7⤵
                                                                              PID:5000
                                                                            • C:\Users\Admin\AppData\Local\Temp\inst.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\inst.exe"
                                                                              7⤵
                                                                                PID:1584
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c Thu03e3edb243781.exe
                                                                          4⤵
                                                                            PID:1188
                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03e3edb243781.exe
                                                                              Thu03e3edb243781.exe
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Checks SCSI registry key(s)
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              PID:1896
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c Thu0362a57cb04.exe
                                                                            4⤵
                                                                              PID:3736
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0362a57cb04.exe
                                                                                Thu0362a57cb04.exe
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:2244
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0362a57cb04.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0362a57cb04.exe" -u
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1724
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c Thu03b3d0969cddc22eb.exe
                                                                              4⤵
                                                                                PID:4040
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu03b3d0969cddc22eb.exe
                                                                                  Thu03b3d0969cddc22eb.exe
                                                                                  5⤵
                                                                                  • Executes dropped EXE
                                                                                  • Modifies registry class
                                                                                  PID:684
                                                                                  • C:\Windows\SysWOW64\control.exe
                                                                                    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\nmpadmoD.cPl",
                                                                                    6⤵
                                                                                      PID:952
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\nmpadmoD.cPl",
                                                                                        7⤵
                                                                                        • Loads dropped DLL
                                                                                        PID:1152
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c Thu033002fdb13a8ca.exe
                                                                                  4⤵
                                                                                    PID:1320
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu033002fdb13a8ca.exe
                                                                                      Thu033002fdb13a8ca.exe
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:2096
                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2144
                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                        6⤵
                                                                                          PID:4740
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c Thu0368bfc54f5c0f8.exe
                                                                                      4⤵
                                                                                        PID:3980
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0368bfc54f5c0f8.exe
                                                                                          Thu0368bfc54f5c0f8.exe
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:2152
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0368bfc54f5c0f8.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0368bfc54f5c0f8.exe
                                                                                            6⤵
                                                                                              PID:4740
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c Thu0388d948c4d2.exe /mixtwo
                                                                                          4⤵
                                                                                            PID:952
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0388d948c4d2.exe
                                                                                              Thu0388d948c4d2.exe /mixtwo
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:1552
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0388d948c4d2.exe
                                                                                                Thu0388d948c4d2.exe /mixtwo
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3696
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "Thu0388d948c4d2.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0388d948c4d2.exe" & exit
                                                                                                  7⤵
                                                                                                    PID:1560
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /im "Thu0388d948c4d2.exe" /f
                                                                                                      8⤵
                                                                                                      • Kills process with taskkill
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:948
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Thu0391445c068b.exe
                                                                                              4⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:820
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0391445c068b.exe
                                                                                                Thu0391445c068b.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1816
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0391445c068b.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS075D4006\Thu0391445c068b.exe
                                                                                                  6⤵
                                                                                                    PID:1092
                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                          1⤵
                                                                                          • Process spawned unexpected child process
                                                                                          PID:4668
                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                            2⤵
                                                                                              PID:4976
                                                                                          • C:\Users\Admin\AppData\Roaming\shbjsbf
                                                                                            C:\Users\Admin\AppData\Roaming\shbjsbf
                                                                                            1⤵
                                                                                              PID:2572
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                              1⤵
                                                                                                PID:1980

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • memory/348-389-0x000001736C9D0000-0x000001736C9D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/348-394-0x000001736C9D0000-0x000001736C9D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/644-145-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                    • memory/644-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                    • memory/644-143-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                    • memory/644-138-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                      Filesize

                                                                                                      572KB

                                                                                                    • memory/644-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                    • memory/644-139-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                      Filesize

                                                                                                      572KB

                                                                                                    • memory/644-140-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                    • memory/644-141-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                      Filesize

                                                                                                      572KB

                                                                                                    • memory/644-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                    • memory/644-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                      Filesize

                                                                                                      100KB

                                                                                                    • memory/644-146-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                      Filesize

                                                                                                      152KB

                                                                                                    • memory/644-144-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.5MB

                                                                                                    • memory/684-215-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/684-219-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1032-434-0x0000022727890000-0x0000022727892000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1032-429-0x0000022727890000-0x0000022727892000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1056-281-0x0000000000D70000-0x0000000000DBC000-memory.dmp

                                                                                                      Filesize

                                                                                                      304KB

                                                                                                    • memory/1056-286-0x0000000000D70000-0x0000000000DBC000-memory.dmp

                                                                                                      Filesize

                                                                                                      304KB

                                                                                                    • memory/1056-318-0x0000000005560000-0x00000000055AE000-memory.dmp

                                                                                                      Filesize

                                                                                                      312KB

                                                                                                    • memory/1056-307-0x00000000030A0000-0x00000000030A6000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                    • memory/1092-409-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/1104-415-0x000001A8151D0000-0x000001A8151D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1104-412-0x000001A8151D0000-0x000001A8151D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1412-443-0x0000013F2EBB0000-0x0000013F2EBB2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1412-441-0x0000013F2EBB0000-0x0000013F2EBB2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1512-233-0x00000000006A0000-0x00000000006A1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1676-287-0x0000000003460000-0x00000000035AE000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                    • memory/1816-244-0x0000000000700000-0x000000000078C000-memory.dmp

                                                                                                      Filesize

                                                                                                      560KB

                                                                                                    • memory/1816-289-0x0000000004F70000-0x0000000004FE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                    • memory/1816-242-0x0000000000700000-0x000000000078C000-memory.dmp

                                                                                                      Filesize

                                                                                                      560KB

                                                                                                    • memory/1816-296-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1816-298-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1816-313-0x0000000005270000-0x000000000528E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/1892-208-0x0000000000780000-0x0000000000788000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/1892-213-0x0000000000780000-0x0000000000788000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/1892-224-0x000000001B3C0000-0x000000001B3C2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1896-260-0x0000000000840000-0x000000000098A000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                    • memory/1896-271-0x0000000000400000-0x000000000083F000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.2MB

                                                                                                    • memory/1896-259-0x0000000000030000-0x0000000000038000-memory.dmp

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                    • memory/1928-370-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-354-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-342-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-435-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-345-0x00000000009C0000-0x00000000009D0000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-378-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-357-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-367-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-413-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-421-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-351-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-402-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-304-0x0000000000850000-0x0000000000866000-memory.dmp

                                                                                                      Filesize

                                                                                                      88KB

                                                                                                    • memory/1928-430-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1928-416-0x00000000009F0000-0x0000000000A00000-memory.dmp

                                                                                                      Filesize

                                                                                                      64KB

                                                                                                    • memory/1928-337-0x00000000009E0000-0x00000000009E2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1952-226-0x0000000000F90000-0x0000000000F96000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                    • memory/1952-240-0x00000000010E0000-0x00000000010E6000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                    • memory/1952-222-0x0000000000960000-0x00000000009AA000-memory.dmp

                                                                                                      Filesize

                                                                                                      296KB

                                                                                                    • memory/1952-218-0x0000000000960000-0x00000000009AA000-memory.dmp

                                                                                                      Filesize

                                                                                                      296KB

                                                                                                    • memory/1952-234-0x0000000000FA0000-0x0000000000FD6000-memory.dmp

                                                                                                      Filesize

                                                                                                      216KB

                                                                                                    • memory/1952-232-0x0000000001130000-0x0000000001132000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1972-198-0x00000000004D0000-0x00000000004D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1972-204-0x00000000004D0000-0x00000000004D1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/1980-390-0x000001EF02A90000-0x000001EF02A92000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/1980-395-0x000001EF02A90000-0x000001EF02A92000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2120-261-0x0000000000D00000-0x0000000000D7C000-memory.dmp

                                                                                                      Filesize

                                                                                                      496KB

                                                                                                    • memory/2120-262-0x0000000000D80000-0x0000000000E55000-memory.dmp

                                                                                                      Filesize

                                                                                                      852KB

                                                                                                    • memory/2120-272-0x0000000000400000-0x00000000008B2000-memory.dmp

                                                                                                      Filesize

                                                                                                      4.7MB

                                                                                                    • memory/2144-285-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                      Filesize

                                                                                                      340KB

                                                                                                    • memory/2144-221-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      816KB

                                                                                                    • memory/2152-291-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2152-314-0x0000000004D70000-0x0000000004D8E000-memory.dmp

                                                                                                      Filesize

                                                                                                      120KB

                                                                                                    • memory/2152-290-0x0000000004B90000-0x0000000004C06000-memory.dmp

                                                                                                      Filesize

                                                                                                      472KB

                                                                                                    • memory/2152-241-0x0000000000320000-0x00000000003AC000-memory.dmp

                                                                                                      Filesize

                                                                                                      560KB

                                                                                                    • memory/2152-243-0x0000000000320000-0x00000000003AC000-memory.dmp

                                                                                                      Filesize

                                                                                                      560KB

                                                                                                    • memory/2152-299-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2328-408-0x000001C8C3BA0000-0x000001C8C3BA2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2328-407-0x000001C8C3BA0000-0x000001C8C3BA2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2352-404-0x000001F0307D0000-0x000001F0307D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2352-401-0x000001F0307D0000-0x000001F0307D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2420-245-0x0000000000C40000-0x0000000000C76000-memory.dmp

                                                                                                      Filesize

                                                                                                      216KB

                                                                                                    • memory/2420-329-0x0000000006AF0000-0x0000000006B56000-memory.dmp

                                                                                                      Filesize

                                                                                                      408KB

                                                                                                    • memory/2420-237-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2420-257-0x0000000006B60000-0x0000000007188000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.2MB

                                                                                                    • memory/2420-239-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2420-324-0x0000000006940000-0x0000000006962000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2420-248-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2420-251-0x0000000000CE2000-0x0000000000CE3000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2508-385-0x000002B6DFD10000-0x000002B6DFD12000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/2508-383-0x000002B6DFD10000-0x000002B6DFD12000-memory.dmp

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                    • memory/3172-258-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                      Filesize

                                                                                                      816KB

                                                                                                    • memory/3688-322-0x0000000006D90000-0x0000000006DB2000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/3688-252-0x0000000006AB0000-0x0000000006AB1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3688-253-0x0000000006AB2000-0x0000000006AB3000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3688-238-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3688-256-0x00000000070F0000-0x0000000007718000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.2MB

                                                                                                    • memory/3688-247-0x0000000004500000-0x0000000004536000-memory.dmp

                                                                                                      Filesize

                                                                                                      216KB

                                                                                                    • memory/3688-236-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/3696-220-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                      Filesize

                                                                                                      320KB

                                                                                                    • memory/3696-231-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                      Filesize

                                                                                                      320KB

                                                                                                    • memory/3724-270-0x00000000008C0000-0x00000000008C1000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4004-312-0x0000000000950000-0x00000000009C9000-memory.dmp

                                                                                                      Filesize

                                                                                                      484KB

                                                                                                    • memory/4004-327-0x00000000053A0000-0x00000000053B2000-memory.dmp

                                                                                                      Filesize

                                                                                                      72KB

                                                                                                    • memory/4004-294-0x0000000074010000-0x00000000741D2000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.8MB

                                                                                                    • memory/4004-295-0x0000000002590000-0x00000000025D5000-memory.dmp

                                                                                                      Filesize

                                                                                                      276KB

                                                                                                    • memory/4004-386-0x00000000746A0000-0x00000000759E8000-memory.dmp

                                                                                                      Filesize

                                                                                                      19.3MB

                                                                                                    • memory/4004-293-0x0000000000C20000-0x0000000000C21000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4004-288-0x0000000000950000-0x00000000009C9000-memory.dmp

                                                                                                      Filesize

                                                                                                      484KB

                                                                                                    • memory/4004-311-0x0000000000950000-0x00000000009C9000-memory.dmp

                                                                                                      Filesize

                                                                                                      484KB

                                                                                                    • memory/4004-305-0x0000000075FB0000-0x00000000760A1000-memory.dmp

                                                                                                      Filesize

                                                                                                      964KB

                                                                                                    • memory/4004-379-0x00000000764B0000-0x0000000076A34000-memory.dmp

                                                                                                      Filesize

                                                                                                      5.5MB

                                                                                                    • memory/4004-315-0x00000000703C0000-0x0000000070440000-memory.dmp

                                                                                                      Filesize

                                                                                                      512KB

                                                                                                    • memory/4004-420-0x000000006F0C0000-0x000000006F10B000-memory.dmp

                                                                                                      Filesize

                                                                                                      300KB

                                                                                                    • memory/4004-325-0x00000000057B0000-0x0000000005DB6000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.0MB

                                                                                                    • memory/4152-306-0x0000000000EF0000-0x0000000000F24000-memory.dmp

                                                                                                      Filesize

                                                                                                      208KB

                                                                                                    • memory/4152-308-0x0000000000EF0000-0x0000000000F24000-memory.dmp

                                                                                                      Filesize

                                                                                                      208KB

                                                                                                    • memory/4152-321-0x0000000005800000-0x0000000005801000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/4152-309-0x0000000001680000-0x0000000001686000-memory.dmp

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                    • memory/4320-320-0x00000000003C0000-0x0000000000510000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                    • memory/4320-319-0x00000000003C0000-0x0000000000510000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.3MB

                                                                                                    • memory/4740-410-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4740-334-0x0000000000400000-0x000000000047C000-memory.dmp

                                                                                                      Filesize

                                                                                                      496KB