00caa54a646237cf00f305613cdd9e0e8dd8e4dcd9706bbdfc71e22f6e673683

Analysis

max time kernel
151s
max time network
144s
platform
windows10_x64
resource
win10-en-20211208
submitted
12/01/2022, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KRAKEN.exe
Size 13.8MB
Sample220112-lzhthacbhm
SHA256 00caa54a646237cf00f305613cdd9e0e8dd8e4dcd9706bbdfc71e22f6e673683
MD5 b00dc98331daf06c9fdd3ac0eb5ca802
SHA1 1fdeb7ea4527b902e43cdac7cf733865513e570e
SHA512 3c2a66f20da63045ab163a1d28a4311f2ec17c7545914983f05948a4c5c5e920166fa748796b6b2d427bdeaceced641417357d906ed857a238d5c1e23ac6c5f6
MD5 SHA1 SHA512

Score

8^/10

persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 23 IoCs

pid	Process
4056	1.exe
3576	2.exe
952	3.exe
1888	RegHost.exe
376	RegHost.exe
3444	RegHost.exe
2732	RegHost.exe
1820	RegHost.exe
440	RegHost.exe
4036	RegHost.exe
3460	RegHost.exe
3536	RegHost.exe
3912	RegHost.exe
3936	RegHost.exe
2864	RegHost.exe
688	RegHost.exe
1268	RegHost.exe
1848	RegHost.exe
3400	RegHost.exe
3192	RegHost.exe
816	RegHost.exe
2044	RegHost.exe
3672	RegHost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001ab33-119.dat	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
952	3.exe
952	3.exe
3496	bfsvc.exe
3496	bfsvc.exe
1888	RegHost.exe
1888	RegHost.exe
3156	bfsvc.exe
3156	bfsvc.exe
376	RegHost.exe
376	RegHost.exe
1080	bfsvc.exe
1080	bfsvc.exe
3444	RegHost.exe
3444	RegHost.exe
2012	bfsvc.exe
2012	bfsvc.exe
2732	RegHost.exe
2732	RegHost.exe
3528	bfsvc.exe
3528	bfsvc.exe
1820	RegHost.exe
1820	RegHost.exe
2676	bfsvc.exe
2676	bfsvc.exe
440	RegHost.exe
440	RegHost.exe
3940	bfsvc.exe
3940	bfsvc.exe
4036	RegHost.exe
4036	RegHost.exe
812	bfsvc.exe
812	bfsvc.exe
3460	RegHost.exe
3460	RegHost.exe
1848	bfsvc.exe
1848	bfsvc.exe
3536	RegHost.exe
3536	RegHost.exe
1044	bfsvc.exe
1044	bfsvc.exe
3912	RegHost.exe
3912	RegHost.exe
4032	bfsvc.exe
4032	bfsvc.exe
3936	RegHost.exe
3936	RegHost.exe
2492	bfsvc.exe
2492	bfsvc.exe
2864	RegHost.exe
2864	RegHost.exe
1436	bfsvc.exe
1436	bfsvc.exe
688	RegHost.exe
688	RegHost.exe
3156	bfsvc.exe
3156	bfsvc.exe
1268	RegHost.exe
1268	RegHost.exe
908	bfsvc.exe
908	bfsvc.exe
1848	RegHost.exe
1848	RegHost.exe
3056	bfsvc.exe
3056	bfsvc.exe

Suspicious use of SetThreadContext 42 IoCs

description	pid	Process	procid_target
PID 952 set thread context of 3496	952	3.exe	75
PID 952 set thread context of 828	952	3.exe	76
PID 1888 set thread context of 3156	1888	RegHost.exe	80
PID 1888 set thread context of 3144	1888	RegHost.exe	82
PID 376 set thread context of 1080	376	RegHost.exe	85
PID 376 set thread context of 908	376	RegHost.exe	86
PID 3444 set thread context of 2012	3444	RegHost.exe	90
PID 3444 set thread context of 2104	3444	RegHost.exe	92
PID 2732 set thread context of 3528	2732	RegHost.exe	95
PID 2732 set thread context of 3248	2732	RegHost.exe	97
PID 1820 set thread context of 2676	1820	RegHost.exe	100
PID 1820 set thread context of 2168	1820	RegHost.exe	102
PID 440 set thread context of 3940	440	RegHost.exe	107
PID 440 set thread context of 1784	440	RegHost.exe	109
PID 4036 set thread context of 812	4036	RegHost.exe	112
PID 4036 set thread context of 1828	4036	RegHost.exe	113
PID 3460 set thread context of 1848	3460	RegHost.exe	117
PID 3460 set thread context of 3120	3460	RegHost.exe	118
PID 3536 set thread context of 1044	3536	RegHost.exe	122
PID 3536 set thread context of 2948	3536	RegHost.exe	123
PID 3912 set thread context of 4032	3912	RegHost.exe	127
PID 3912 set thread context of 1740	3912	RegHost.exe	129
PID 3936 set thread context of 2492	3936	RegHost.exe	132
PID 3936 set thread context of 924	3936	RegHost.exe	134
PID 2864 set thread context of 1436	2864	RegHost.exe	137
PID 2864 set thread context of 4060	2864	RegHost.exe	139
PID 688 set thread context of 3156	688	RegHost.exe	142
PID 688 set thread context of 1992	688	RegHost.exe	143
PID 1268 set thread context of 908	1268	RegHost.exe	147
PID 1268 set thread context of 1920	1268	RegHost.exe	149
PID 1848 set thread context of 3056	1848	RegHost.exe	152
PID 1848 set thread context of 2816	1848	RegHost.exe	154
PID 3400 set thread context of 2948	3400	RegHost.exe	157
PID 3400 set thread context of 1284	3400	RegHost.exe	158
PID 3192 set thread context of 1820	3192	RegHost.exe	162
PID 3192 set thread context of 3608	3192	RegHost.exe	163
PID 816 set thread context of 3824	816	RegHost.exe	167
PID 816 set thread context of 3872	816	RegHost.exe	168
PID 2044 set thread context of 3692	2044	RegHost.exe	172
PID 2044 set thread context of 1040	2044	RegHost.exe	173
PID 3672 set thread context of 2272	3672	RegHost.exe	177
PID 3672 set thread context of 4036	3672	RegHost.exe	178

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2668	4056	WerFault.exe	69

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3576	2.exe
3576	2.exe
3576	2.exe
3576	2.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
2668	WerFault.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
828	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe
908	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2668	WerFault.exe
Token: SeBackupPrivilege	2668	WerFault.exe
Token: SeDebugPrivilege	2668	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4056	3480	KRAKEN.exe	69
PID 3480 wrote to memory of 4056	3480	KRAKEN.exe	69
PID 3480 wrote to memory of 4056	3480	KRAKEN.exe	69
PID 3480 wrote to memory of 3576	3480	KRAKEN.exe	70
PID 3480 wrote to memory of 3576	3480	KRAKEN.exe	70
PID 3480 wrote to memory of 952	3480	KRAKEN.exe	73
PID 3480 wrote to memory of 952	3480	KRAKEN.exe	73
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 3496	952	3.exe	75
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 952 wrote to memory of 828	952	3.exe	76
PID 828 wrote to memory of 1888	828	explorer.exe	78
PID 828 wrote to memory of 1888	828	explorer.exe	78
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80
PID 1888 wrote to memory of 3156	1888	RegHost.exe	80

C:\Users\Admin\AppData\Local\Temp\KRAKEN.exe
"C:\Users\Admin\AppData\Local\Temp\KRAKEN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Roaming\1.exe
  C:\Users\Admin\AppData\Roaming\1.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 400
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\Users\Admin\AppData\Roaming\2.exe
  C:\Users\Admin\AppData\Roaming\2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3576
- C:\Users\Admin\AppData\Roaming\3.exe
  C:\Users\Admin\AppData\Roaming\3.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\bfsvc.exe
    C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3496
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        5⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3156
    - - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3144
      - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:376
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1080
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:908
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3444
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        9⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2012
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        9⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2732
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        11⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3528
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        11⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1820
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        13⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2676
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        13⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:440
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        15⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3940
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        15⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4036
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        17⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:812
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        17⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3460
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        19⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1848
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        19⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3536
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        21⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1044
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        21⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3912
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        23⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4032
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        23⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:3936
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        25⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2492
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        25⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:2864
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        27⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1436
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        27⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        28⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:688
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        29⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3156
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        29⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        30⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1268
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        31⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:908
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        31⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:1848
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        33⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3056
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        33⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3400
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        35⤵
        
        PID:2948
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        35⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3192
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        37⤵
        
        PID:1820
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        37⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        38⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:816
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        39⤵
        
        PID:3824
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        39⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        40⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2044
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        41⤵
        
        PID:3692
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        41⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        42⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3672
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x84564F93A264a4d4B67f91348B586b6aee1f5cA8 -coin etc -worker 1
        43⤵
        
        PID:2272
        
        C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        43⤵
        
        PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/376-147-0x00007FF78CD20000-0x00007FF78D0F1000-memory.dmp

Download

memory/376-148-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/376-149-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/440-193-0x00007FF78D300000-0x00007FF78D6D1000-memory.dmp

Download

memory/440-191-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/440-192-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/688-270-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/688-269-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/688-268-0x00007FF78CC50000-0x00007FF78D021000-memory.dmp

Download

memory/812-210-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/816-329-0x00007FF78CF30000-0x00007FF78D301000-memory.dmp

Download

memory/828-129-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/828-131-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/908-154-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/908-287-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/924-253-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/952-125-0x00007FF6A69F0000-0x00007FF6A806F000-memory.dmp

Download

memory/952-124-0x00007FF6A69F0000-0x00007FF6A806F000-memory.dmp

Download

memory/952-126-0x00007FF6A5640000-0x00007FF6A5A11000-memory.dmp

Download

memory/1040-341-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1044-232-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1080-155-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1268-281-0x00007FF78CE60000-0x00007FF78D231000-memory.dmp

Download

memory/1268-280-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1268-279-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1284-308-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1436-265-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1740-242-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1784-198-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1820-180-0x00007FF78D2D0000-0x00007FF78D6A1000-memory.dmp

Download

memory/1820-320-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1820-181-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1820-182-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1828-209-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1848-292-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1848-221-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/1848-291-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1848-290-0x00007FF78D0B0000-0x00007FF78D481000-memory.dmp

Download

memory/1888-136-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1888-137-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/1888-142-0x00007FF78C9E0000-0x00007FF78CDB1000-memory.dmp

Download

memory/1920-286-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/1992-275-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2012-166-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2044-336-0x00007FF78D320000-0x00007FF78D6F1000-memory.dmp

Download

memory/2104-165-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2168-187-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2492-254-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2676-188-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2732-171-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/2732-170-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/2732-169-0x00007FF78CDF0000-0x00007FF78D1C1000-memory.dmp

Download

memory/2816-297-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/2864-259-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/2864-258-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/2864-257-0x00007FF78CBA0000-0x00007FF78CF71000-memory.dmp

Download

memory/2948-309-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/2948-231-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3056-298-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3120-220-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3144-143-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3156-276-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3156-144-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3192-313-0x00007FF78CFC0000-0x00007FF78D391000-memory.dmp

Download

memory/3248-176-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3400-301-0x00007FF78D760000-0x00007FF78DB31000-memory.dmp

Download

memory/3444-158-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3444-159-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3444-160-0x00007FF78CCC0000-0x00007FF78D091000-memory.dmp

Download

memory/3460-213-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3460-214-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3460-216-0x00007FF78D160000-0x00007FF78D531000-memory.dmp

Download

memory/3496-132-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3496-127-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3528-177-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3536-226-0x00007FF78CD60000-0x00007FF78D131000-memory.dmp

Download

memory/3536-224-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3536-225-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3608-319-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3672-345-0x00007FF78CC00000-0x00007FF78CFD1000-memory.dmp

Download

memory/3692-342-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3824-331-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/3872-330-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/3912-238-0x00007FF78CD10000-0x00007FF78D0E1000-memory.dmp

Download

memory/3912-236-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3912-235-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3936-247-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3936-246-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/3936-248-0x00007FF78CDB0000-0x00007FF78D181000-memory.dmp

Download

memory/3940-199-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4032-243-0x0000000140000000-0x0000000140815000-memory.dmp

Download

memory/4036-351-0x0000000140000000-0x0000000140022000-memory.dmp

Download

memory/4036-203-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/4036-204-0x00007FF78D880000-0x00007FF78DC51000-memory.dmp

Download

memory/4036-202-0x00007FF78DEE0000-0x00007FF78F55F000-memory.dmp

Download

memory/4056-120-0x0000000002560000-0x00000000025C0000-memory.dmp

Download

memory/4060-264-0x0000000140000000-0x0000000140022000-memory.dmp

Download