onlylogger | 4bf7e42dbb9b672b3ad79dcece4dbf8a0ffdea5634ce7f6425d05b31ca1a92ff

Analysis

max time kernel
78s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
19/01/2022, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6e1e712218d7be57c7b7035edd5cbb7.exe
Size 8.0MB
Sample220119-3qlmgaebal
SHA256 4bf7e42dbb9b672b3ad79dcece4dbf8a0ffdea5634ce7f6425d05b31ca1a92ff
MD5 a6e1e712218d7be57c7b7035edd5cbb7
SHA1 d541b4c7d40ad12665afab24d664e0a2db2e24ba
SHA512 ce0f8b024f6b3985499e62c55ca4da041d04239cf7eddee4830bb27d35f3f90831c782b22a45498628546b3660a3333db133593166d5b4abdf15592f96c0081e
MD5 SHA1 SHA512

Score

10^/10

onlylogger smokeloader socelars aspackv2 backdoor discovery loader persistence spyware stealer suricata trojan upx

Malware Config

Extracted

Family

socelars

http://www.kvubgc.com/

Extracted

Family

smokeloader

Version

2020

http://host-data-coin-11.com/
http://file-coin-host-12.com/

rc4.i32

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	2228	rundll32.exe	120
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	336	2228	rundll32.exe	120

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000022121-185.dat	family_socelars
behavioral2/files/0x0007000000022121-155.dat	family_socelars

Suspicious use of NtCreateProcessExOtherParentProcess 7 IoCs

description	pid	Process	procid_target
PID 4316 created 3856	4316	WerFault.exe	89
PID 4304 created 3604	4304	WerFault.exe	70
PID 4320 created 3856	4320	WerFault.exe	89
PID 4488 created 3856	4488	61e59be8847ce_Mon16d36d8a68.exe	89
PID 112 created 5044	112	WerFault.exe	128
PID 1696 created 3652	1696	WerFault.exe	130
PID 1860 created 3856	1860	WerFault.exe	89

suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

OnlyLogger Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3856-283-0x0000000000760000-0x00000000007AC000-memory.dmp	family_onlylogger
behavioral2/memory/3856-284-0x0000000000400000-0x00000000005F4000-memory.dmp	family_onlylogger

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0006000000022136-135.dat	aspack_v212_v242
behavioral2/files/0x0007000000022135-136.dat	aspack_v212_v242
behavioral2/files/0x0007000000022135-140.dat	aspack_v212_v242
behavioral2/files/0x0007000000022135-139.dat	aspack_v212_v242
behavioral2/files/0x0006000000022136-138.dat	aspack_v212_v242
behavioral2/files/0x0006000000022138-143.dat	aspack_v212_v242
behavioral2/files/0x0006000000022138-144.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 33 IoCs

pid	Process
3024	setup_installer.exe
3868	setup_install.exe
2592	61e59bf4142c3_Mon16e8cda455d.exe
548	61e59bee22906_Mon168d46fc88.exe
3960	61e59be9c2a2e_Mon16685386e4.exe
3572	61e59be837ad2_Mon16e9dab6.exe
2780	61e59be8847ce_Mon16d36d8a68.exe
3984	61e59bec910ce_Mon1669a720.exe
3856	61e59bef472d0_Mon1620b457b7.exe
308	61e59be347cec_Mon168ad5c1c0.exe
1908	61e59be429b18_Mon1664da5b3cc.exe
1848	61e59bf0d8435_Mon164e797e35.exe
3236	61e59bf4ed123_Mon16d77cb4c1.exe
3720	61e59be70fabb_Mon1647f3c3f0.exe
3732	61e59be5e9557_Mon16fc32af8c71.exe
3604	61e59bf1f2b0e_Mon16a6c2631.exe
1696	WerFault.exe
3344	61e59be70fabb_Mon1647f3c3f0.tmp
2972	61e59be9c2a2e_Mon16685386e4.exe
4172	61e59bed53f77_Mon16d2cb4a2f.exe
4180	61e59bed53f77_Mon16d2cb4a2f.exe
4388	61e59be70fabb_Mon1647f3c3f0.exe
4468	11111.exe
4548	61e59be70fabb_Mon1647f3c3f0.tmp
4460	61e59bee22906_Mon168d46fc88.exe
4504	61e59be347cec_Mon168ad5c1c0.exe
5048	6ba96d49-9cfc-4d2d-b1ae-da0259197611.exe
5060	AC65.tmp.exe
2740	dbcd1c71-c060-4333-96fc-997a38a94b97.exe
3076	B521.tmp.exe
4416	5198b289-3d5e-4328-9c01-4f887cfd873c.exe
1228	dllhostwin.exe
4488	61e59be8847ce_Mon16d36d8a68.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002214b-254.dat	upx
behavioral2/files/0x000700000002214b-256.dat	upx

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	a6e1e712218d7be57c7b7035edd5cbb7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	setup_installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	61e59be70fabb_Mon1647f3c3f0.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	61e59be8847ce_Mon16d36d8a68.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	61e59bf4ed123_Mon16d77cb4c1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	61e59bf4142c3_Mon16e8cda455d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	61e59bf0d8435_Mon164e797e35.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YipJB9aCzMhsxveg.exe	B521.tmp.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YipJB9aCzMhsxveg.exe	B521.tmp.exe

Loads dropped DLL 12 IoCs

pid	Process
3868	setup_install.exe
3868	setup_install.exe
3868	setup_install.exe
3868	setup_install.exe
3868	setup_install.exe
3868	setup_install.exe
3344	61e59be70fabb_Mon1647f3c3f0.tmp
4548	61e59be70fabb_Mon1647f3c3f0.tmp
4352	regsvr32.exe
4352	regsvr32.exe
3652	rundll32.exe
5044	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe"	dbcd1c71-c060-4333-96fc-997a38a94b97.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
29	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3984	61e59bec910ce_Mon1669a720.exe
5048	6ba96d49-9cfc-4d2d-b1ae-da0259197611.exe
2740	dbcd1c71-c060-4333-96fc-997a38a94b97.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3960 set thread context of 2972	3960	61e59be9c2a2e_Mon16685386e4.exe	80
PID 548 set thread context of 4460	548	61e59bee22906_Mon168d46fc88.exe	86
PID 308 set thread context of 4504	308	61e59be347cec_Mon168ad5c1c0.exe	107
PID 2780 set thread context of 4488	2780	61e59be8847ce_Mon16d36d8a68.exe	137

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AtomTweaker\unins000.dat	WerFault.exe
File created	C:\Program Files (x86)\AtomTweaker\is-P140G.tmp	WerFault.exe
File opened for modification	C:\Program Files (x86)\AtomTweaker\unins000.dat	WerFault.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
4400	3856	WerFault.exe
4436	3604	WerFault.exe	70
4364	3856	WerFault.exe	89
3692	3856	WerFault.exe	89
2940	5044	WerFault.exe	128
2920	3652	WerFault.exe	130
2588	3856	WerFault.exe	89
3812	3856	WerFault.exe	89
4548	3856	WerFault.exe	89
4552	3856	WerFault.exe	89

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	61e59be9c2a2e_Mon16685386e4.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	61e59be9c2a2e_Mon16685386e4.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	61e59be9c2a2e_Mon16685386e4.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5040	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4640	PING.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	37	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3984	61e59bec910ce_Mon1669a720.exe
3984	61e59bec910ce_Mon1669a720.exe
2780	61e59be8847ce_Mon16d36d8a68.exe
2972	61e59be9c2a2e_Mon16685386e4.exe
2972	61e59be9c2a2e_Mon16685386e4.exe
3252	powershell.exe
4468	11111.exe
4468	11111.exe
4468	11111.exe
4468	11111.exe
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
4436	WerFault.exe
4436	WerFault.exe
2424	Process not Found
2424	Process not Found
4584	powershell.exe
4584	powershell.exe
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
4400	WerFault.exe
4400	WerFault.exe
2424	Process not Found
2424	Process not Found
3252	powershell.exe
3252	powershell.exe
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found
2424	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2972	61e59be9c2a2e_Mon16685386e4.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeAssignPrimaryTokenPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeLockMemoryPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeIncreaseQuotaPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeMachineAccountPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeTcbPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeSecurityPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeTakeOwnershipPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeLoadDriverPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeSystemProfilePrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeSystemtimePrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeProfSingleProcessPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeIncBasePriorityPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeCreatePagefilePrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeCreatePermanentPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeBackupPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeRestorePrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeShutdownPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeDebugPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeAuditPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeSystemEnvironmentPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeChangeNotifyPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeRemoteShutdownPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeUndockPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeSyncAgentPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeEnableDelegationPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeManageVolumePrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeImpersonatePrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeCreateGlobalPrivilege	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: 31	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: 32	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: 33	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: 34	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: 35	3732	61e59be5e9557_Mon16fc32af8c71.exe
Token: SeDebugPrivilege	2780	61e59be8847ce_Mon16d36d8a68.exe
Token: SeDebugPrivilege	308	61e59be347cec_Mon168ad5c1c0.exe
Token: SeDebugPrivilege	548	61e59bee22906_Mon168d46fc88.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	3572	61e59be837ad2_Mon16e9dab6.exe
Token: SeRestorePrivilege	4400	WerFault.exe
Token: SeBackupPrivilege	4400	WerFault.exe
Token: SeRestorePrivilege	4436	WerFault.exe
Token: SeBackupPrivilege	4436	WerFault.exe
Token: SeBackupPrivilege	4436	WerFault.exe
Token: SeDebugPrivilege	3236	61e59bf4ed123_Mon16d77cb4c1.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeDebugPrivilege	2740	dbcd1c71-c060-4333-96fc-997a38a94b97.exe
Token: SeDebugPrivilege	5060	AC65.tmp.exe
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found
Token: SeShutdownPrivilege	2424	Process not Found
Token: SeCreatePagefilePrivilege	2424	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4548	WerFault.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1696	WerFault.exe
1696	WerFault.exe
4172	61e59bed53f77_Mon16d2cb4a2f.exe
4172	61e59bed53f77_Mon16d2cb4a2f.exe
4180	61e59bed53f77_Mon16d2cb4a2f.exe
4180	61e59bed53f77_Mon16d2cb4a2f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3024	2636	a6e1e712218d7be57c7b7035edd5cbb7.exe	57
PID 2636 wrote to memory of 3024	2636	a6e1e712218d7be57c7b7035edd5cbb7.exe	57
PID 2636 wrote to memory of 3024	2636	a6e1e712218d7be57c7b7035edd5cbb7.exe	57
PID 3024 wrote to memory of 3868	3024	setup_installer.exe	58
PID 3024 wrote to memory of 3868	3024	setup_installer.exe	58
PID 3024 wrote to memory of 3868	3024	setup_installer.exe	58
PID 3868 wrote to memory of 1852	3868	setup_install.exe	60
PID 3868 wrote to memory of 1852	3868	setup_install.exe	60
PID 3868 wrote to memory of 1852	3868	setup_install.exe	60
PID 3868 wrote to memory of 1992	3868	setup_install.exe	61
PID 3868 wrote to memory of 1992	3868	setup_install.exe	61
PID 3868 wrote to memory of 1992	3868	setup_install.exe	61
PID 3868 wrote to memory of 2660	3868	setup_install.exe	62
PID 3868 wrote to memory of 2660	3868	setup_install.exe	62
PID 3868 wrote to memory of 2660	3868	setup_install.exe	62
PID 3868 wrote to memory of 3012	3868	setup_install.exe	102
PID 3868 wrote to memory of 3012	3868	setup_install.exe	102
PID 3868 wrote to memory of 3012	3868	setup_install.exe	102
PID 3868 wrote to memory of 752	3868	setup_install.exe	101
PID 3868 wrote to memory of 752	3868	setup_install.exe	101
PID 3868 wrote to memory of 752	3868	setup_install.exe	101
PID 3868 wrote to memory of 2184	3868	setup_install.exe	100
PID 3868 wrote to memory of 2184	3868	setup_install.exe	100
PID 3868 wrote to memory of 2184	3868	setup_install.exe	100
PID 3868 wrote to memory of 648	3868	setup_install.exe	99
PID 3868 wrote to memory of 648	3868	setup_install.exe	99
PID 3868 wrote to memory of 648	3868	setup_install.exe	99
PID 3868 wrote to memory of 4008	3868	setup_install.exe	98
PID 3868 wrote to memory of 4008	3868	setup_install.exe	98
PID 3868 wrote to memory of 4008	3868	setup_install.exe	98
PID 3868 wrote to memory of 1316	3868	setup_install.exe	97
PID 3868 wrote to memory of 1316	3868	setup_install.exe	97
PID 3868 wrote to memory of 1316	3868	setup_install.exe	97
PID 3868 wrote to memory of 1176	3868	setup_install.exe	96
PID 3868 wrote to memory of 1176	3868	setup_install.exe	96
PID 3868 wrote to memory of 1176	3868	setup_install.exe	96
PID 3868 wrote to memory of 384	3868	setup_install.exe	95
PID 3868 wrote to memory of 384	3868	setup_install.exe	95
PID 3868 wrote to memory of 384	3868	setup_install.exe	95
PID 3868 wrote to memory of 3080	3868	setup_install.exe	94
PID 3868 wrote to memory of 3080	3868	setup_install.exe	94
PID 3868 wrote to memory of 3080	3868	setup_install.exe	94
PID 3868 wrote to memory of 2860	3868	setup_install.exe	63
PID 3868 wrote to memory of 2860	3868	setup_install.exe	63
PID 3868 wrote to memory of 2860	3868	setup_install.exe	63
PID 3868 wrote to memory of 3652	3868	setup_install.exe	93
PID 3868 wrote to memory of 3652	3868	setup_install.exe	93
PID 3868 wrote to memory of 3652	3868	setup_install.exe	93
PID 3868 wrote to memory of 1088	3868	setup_install.exe	92
PID 3868 wrote to memory of 1088	3868	setup_install.exe	92
PID 3868 wrote to memory of 1088	3868	setup_install.exe	92
PID 3868 wrote to memory of 1920	3868	setup_install.exe	91
PID 3868 wrote to memory of 1920	3868	setup_install.exe	91
PID 3868 wrote to memory of 1920	3868	setup_install.exe	91
PID 1088 wrote to memory of 2592	1088	cmd.exe	64
PID 1088 wrote to memory of 2592	1088	cmd.exe	64
PID 1088 wrote to memory of 2592	1088	cmd.exe	64
PID 384 wrote to memory of 548	384	cmd.exe	65
PID 384 wrote to memory of 548	384	cmd.exe	65
PID 384 wrote to memory of 548	384	cmd.exe	65
PID 4008 wrote to memory of 3960	4008	cmd.exe	66
PID 4008 wrote to memory of 3960	4008	cmd.exe	66
PID 4008 wrote to memory of 3960	4008	cmd.exe	66
PID 2184 wrote to memory of 3572	2184	cmd.exe	67

C:\Users\Admin\AppData\Local\Temp\a6e1e712218d7be57c7b7035edd5cbb7.exe
"C:\Users\Admin\AppData\Local\Temp\a6e1e712218d7be57c7b7035edd5cbb7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      PID:1852
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be347cec_Mon168ad5c1c0.exe
      4⤵
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be347cec_Mon168ad5c1c0.exe
        
        61e59be347cec_Mon168ad5c1c0.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:308
      - C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be347cec_Mon168ad5c1c0.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be347cec_Mon168ad5c1c0.exe
        6⤵
        Executes dropped EXE
        
        PID:4504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be429b18_Mon1664da5b3cc.exe
      4⤵
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be429b18_Mon1664da5b3cc.exe
        
        61e59be429b18_Mon1664da5b3cc.exe
        5⤵
        Executes dropped EXE
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bf0d8435_Mon164e797e35.exe
      4⤵
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bf0d8435_Mon164e797e35.exe
        
        61e59bf0d8435_Mon164e797e35.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:1848
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" WxZW4Xi2.fp /s
        6⤵
        Loads dropped DLL
        
        PID:4352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bf4ed123_Mon16d77cb4c1.exe
      4⤵
      PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bf4142c3_Mon16e8cda455d.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1088
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bf1f2b0e_Mon16a6c2631.exe
      4⤵
      PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bef472d0_Mon1620b457b7.exe /mixtwo
      4⤵
      PID:3080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bee22906_Mon168d46fc88.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:384
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bed53f77_Mon16d2cb4a2f.exe
      4⤵
      PID:1176
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59bec910ce_Mon1669a720.exe
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be9c2a2e_Mon16685386e4.exe
      4⤵
      PID:4008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be8847ce_Mon16d36d8a68.exe
      4⤵
      PID:648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be837ad2_Mon16e9dab6.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2184
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be70fabb_Mon1647f3c3f0.exe
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 61e59be5e9557_Mon16fc32af8c71.exe
      4⤵
      PID:3012

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bf4142c3_Mon16e8cda455d.exe
61e59bf4142c3_Mon16e8cda455d.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:2592
- C:\Users\Admin\AppData\Roaming\AC65.tmp.exe
  "C:\Users\Admin\AppData\Roaming\AC65.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Users\Admin\AppData\Roaming\B521.tmp.exe
  "C:\Users\Admin\AppData\Roaming\B521.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  PID:3076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bf4142c3_Mon16e8cda455d.exe" >> NUL
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4640

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bee22906_Mon168d46fc88.exe
61e59bee22906_Mon168d46fc88.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:548
- C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bee22906_Mon168d46fc88.exe
  C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bee22906_Mon168d46fc88.exe
  2⤵
  - Executes dropped EXE
  PID:4460

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be9c2a2e_Mon16685386e4.exe
61e59be9c2a2e_Mon16685386e4.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3960
- C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be9c2a2e_Mon16685386e4.exe
  61e59be9c2a2e_Mon16685386e4.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2972

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be837ad2_Mon16e9dab6.exe
61e59be837ad2_Mon16e9dab6.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3572

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bec910ce_Mon1669a720.exe
61e59bec910ce_Mon1669a720.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3984

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be5e9557_Mon16fc32af8c71.exe
61e59be5e9557_Mon16fc32af8c71.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:3220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5040

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bf1f2b0e_Mon16a6c2631.exe
61e59bf1f2b0e_Mon16a6c2631.exe
1⤵
- Executes dropped EXE
PID:3604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 344
  2⤵
  - Drops file in Windows directory
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4436

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be70fabb_Mon1647f3c3f0.exe
61e59be70fabb_Mon1647f3c3f0.exe
1⤵
- Executes dropped EXE
PID:3720
- C:\Users\Admin\AppData\Local\Temp\is-T90EV.tmp\61e59be70fabb_Mon1647f3c3f0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-T90EV.tmp\61e59be70fabb_Mon1647f3c3f0.tmp" /SL5="$F0030,140765,56832,C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be70fabb_Mon1647f3c3f0.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Loads dropped DLL
  PID:3344

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bed53f77_Mon16d2cb4a2f.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bed53f77_Mon16d2cb4a2f.exe" -a
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3604 -ip 3604
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3856 -ip 3856
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 624
1⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be70fabb_Mon1647f3c3f0.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be70fabb_Mon1647f3c3f0.exe" /SILENT
1⤵
- Executes dropped EXE
PID:4388
- C:\Users\Admin\AppData\Local\Temp\is-0CO0S.tmp\61e59be70fabb_Mon1647f3c3f0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0CO0S.tmp\61e59be70fabb_Mon1647f3c3f0.tmp" /SL5="$2021A,140765,56832,C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be70fabb_Mon1647f3c3f0.exe" /SILENT
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\is-BVVC4.tmp\dllhostwin.exe
    "C:\Users\Admin\AppData\Local\Temp\is-BVVC4.tmp\dllhostwin.exe" 77
    3⤵
    - Executes dropped EXE
    PID:1228

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bed53f77_Mon16d2cb4a2f.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bed53f77_Mon16d2cb4a2f.exe" -a
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4172

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bed53f77_Mon16d2cb4a2f.exe
61e59bed53f77_Mon16d2cb4a2f.exe
1⤵
PID:1696

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bf4ed123_Mon16d77cb4c1.exe
61e59bf4ed123_Mon16d77cb4c1.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:3236
- C:\Users\Admin\AppData\Local\Temp\6ba96d49-9cfc-4d2d-b1ae-da0259197611.exe
  "C:\Users\Admin\AppData\Local\Temp\6ba96d49-9cfc-4d2d-b1ae-da0259197611.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\dbcd1c71-c060-4333-96fc-997a38a94b97.exe
  "C:\Users\Admin\AppData\Local\Temp\dbcd1c71-c060-4333-96fc-997a38a94b97.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\5198b289-3d5e-4328-9c01-4f887cfd873c.exe
  "C:\Users\Admin\AppData\Local\Temp\5198b289-3d5e-4328-9c01-4f887cfd873c.exe"
  2⤵
  - Executes dropped EXE
  PID:4416

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59bef472d0_Mon1620b457b7.exe
61e59bef472d0_Mon1620b457b7.exe /mixtwo
1⤵
- Executes dropped EXE
PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 636
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 748
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 840
  2⤵
  - Program crash
  PID:2588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 676
  2⤵
  - Program crash
  PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 692
  2⤵
  - Drops file in Program Files directory
  - Program crash
  - Suspicious use of FindShellTrayWindow
  PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 888
  2⤵
  - Program crash
  PID:4552

C:\Users\Admin\AppData\Local\Temp\7zS0DB1D76E\61e59be8847ce_Mon16d36d8a68.exe
61e59be8847ce_Mon16d36d8a68.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\61e59be8847ce_Mon16d36d8a68.exe
  C:\Users\Admin\AppData\Local\Temp\61e59be8847ce_Mon16d36d8a68.exe
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Executes dropped EXE
  PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3856 -ip 3856
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3856 -ip 3856
1⤵
PID:4488

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:4068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  - Loads dropped DLL
  PID:5044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 612
    3⤵
    - Program crash
    PID:2940

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
1⤵
- Process spawned unexpected child process
PID:336
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",global
  2⤵
  - Loads dropped DLL
  PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 604
    3⤵
    - Program crash
    PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5044 -ip 5044
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3652 -ip 3652
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3856 -ip 3856
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3856 -ip 3856
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3856 -ip 3856
1⤵
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3856 -ip 3856
1⤵
PID:4436

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe c52df6333248f7e873b8d78c433e4dad C25sboTFCk+5gsrP8JQ7OQ.0.1.0.0.0
1⤵
PID:112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/308-193-0x0000000000A90000-0x0000000000B1A000-memory.dmp

Download

memory/308-230-0x0000000002EC0000-0x0000000002EDE000-memory.dmp

Download

memory/548-195-0x0000000000520000-0x00000000005AA000-memory.dmp

Download

memory/548-215-0x0000000004E20000-0x0000000004E96000-memory.dmp

Download

memory/2424-296-0x0000000007E70000-0x0000000007E86000-memory.dmp

Download

memory/2740-308-0x00000000000D0000-0x0000000000111000-memory.dmp

Download

memory/2740-306-0x00000000000D0000-0x0000000000111000-memory.dmp

Download

memory/2740-303-0x0000000076940000-0x0000000076B55000-memory.dmp

Download

memory/2740-301-0x00000000007E0000-0x00000000007E1000-memory.dmp

Download

memory/2740-311-0x0000000076DE0000-0x0000000077393000-memory.dmp

Download

memory/2740-310-0x00000000711F0000-0x0000000071279000-memory.dmp

Download

memory/2740-316-0x0000000005270000-0x0000000005271000-memory.dmp

Download

memory/2740-305-0x0000000000B00000-0x0000000000B44000-memory.dmp

Download

memory/2780-202-0x0000000000390000-0x0000000000530000-memory.dmp

Download

memory/2780-221-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/2780-223-0x0000000005500000-0x0000000005AA4000-memory.dmp

Download

memory/2972-227-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/2972-262-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3076-312-0x0000000000640000-0x000000000066F000-memory.dmp

Download

memory/3076-320-0x0000000000590000-0x0000000000593000-memory.dmp

Download

memory/3236-200-0x0000000000860000-0x0000000000861000-memory.dmp

Download

memory/3236-281-0x0000000002450000-0x000000000248B000-memory.dmp

Download

memory/3236-275-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/3236-186-0x0000000000840000-0x0000000000841000-memory.dmp

Download

memory/3236-261-0x0000000002E10000-0x0000000002EA2000-memory.dmp

Download

memory/3236-244-0x0000000002360000-0x0000000002378000-memory.dmp

Download

memory/3236-292-0x00000000054B2000-0x00000000054B3000-memory.dmp

Download

memory/3236-293-0x00000000054B3000-0x00000000054B4000-memory.dmp

Download

memory/3236-181-0x0000000000400000-0x000000000062F000-memory.dmp

Download

memory/3236-295-0x00000000054B4000-0x00000000054B5000-memory.dmp

Download

memory/3252-248-0x0000000007930000-0x0000000007952000-memory.dmp

Download

memory/3252-255-0x00000000079D0000-0x0000000007A36000-memory.dmp

Download

memory/3252-277-0x0000000004920000-0x0000000006C50000-memory.dmp

Download

memory/3252-198-0x0000000006B00000-0x0000000006B36000-memory.dmp

Download

memory/3252-257-0x0000000007BF0000-0x0000000007C56000-memory.dmp

Download

memory/3252-219-0x0000000004920000-0x0000000006C50000-memory.dmp

Download

memory/3252-204-0x0000000007280000-0x00000000078A8000-memory.dmp

Download

memory/3252-282-0x00000000080B0000-0x00000000080CE000-memory.dmp

Download

memory/3572-291-0x00000000025B0000-0x00000000025C6000-memory.dmp

Download

memory/3572-210-0x00000000009B0000-0x00000000009F4000-memory.dmp

Download

memory/3572-225-0x0000000002210000-0x0000000002249000-memory.dmp

Download

memory/3572-231-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/3572-289-0x00000000025C3000-0x00000000025C4000-memory.dmp

Download

memory/3572-288-0x00000000025C2000-0x00000000025C3000-memory.dmp

Download

memory/3572-287-0x00000000025C0000-0x00000000025C1000-memory.dmp

Download

memory/3604-286-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/3604-222-0x0000000000800000-0x0000000000829000-memory.dmp

Download

memory/3604-279-0x00000000006E0000-0x00000000006E9000-memory.dmp

Download

memory/3720-184-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3856-211-0x00000000007F0000-0x0000000000834000-memory.dmp

Download

memory/3856-284-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/3856-283-0x0000000000760000-0x00000000007AC000-memory.dmp

Download

memory/3868-147-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3868-151-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3868-148-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3868-196-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/3868-149-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3868-146-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3868-150-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3868-145-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3868-152-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3868-189-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3868-183-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3868-194-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3960-209-0x0000000000830000-0x0000000000859000-memory.dmp

Download

memory/3960-234-0x00000000020D0000-0x00000000020D9000-memory.dmp

Download

memory/3984-197-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

memory/3984-207-0x0000000000920000-0x0000000000A6F000-memory.dmp

Download

memory/3984-241-0x0000000005490000-0x00000000054CC000-memory.dmp

Download

memory/3984-243-0x0000000076DE0000-0x0000000077393000-memory.dmp

Download

memory/3984-235-0x0000000005560000-0x000000000566A000-memory.dmp

Download

memory/3984-290-0x0000000005390000-0x0000000005401000-memory.dmp

Download

memory/3984-216-0x00000000711F0000-0x0000000071279000-memory.dmp

Download

memory/3984-212-0x0000000000920000-0x0000000000A6F000-memory.dmp

Download

memory/3984-192-0x0000000000920000-0x0000000000A6F000-memory.dmp

Download

memory/3984-247-0x000000006E780000-0x000000006E7CC000-memory.dmp

Download

memory/3984-201-0x0000000076940000-0x0000000076B55000-memory.dmp

Download

memory/3984-280-0x0000000002A00000-0x0000000002A46000-memory.dmp

Download

memory/3984-224-0x0000000005A30000-0x0000000006048000-memory.dmp

Download

memory/3984-228-0x0000000005430000-0x0000000005442000-memory.dmp

Download

memory/4352-1463-0x000000002FC90000-0x000000002FDDB000-memory.dmp

Download

memory/4352-1465-0x000000002FC90000-0x000000002FDDB000-memory.dmp

Download

memory/4352-327-0x0000000004BC0000-0x000000002F698000-memory.dmp

Download

memory/4352-1456-0x000000002FC90000-0x000000002FD40000-memory.dmp

Download

memory/4388-251-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4460-265-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4460-274-0x0000000004FA0000-0x00000000055B8000-memory.dmp

Download

memory/4488-960-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4504-278-0x0000000005440000-0x0000000005A58000-memory.dmp

Download

memory/4504-268-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4548-294-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/4584-285-0x0000000004CA0000-0x0000000006E40000-memory.dmp

Download

memory/4584-270-0x0000000004CA0000-0x0000000006E40000-memory.dmp

Download

memory/5048-324-0x0000000076DE0000-0x0000000077393000-memory.dmp

Download

memory/5048-309-0x00000000711F0000-0x0000000071279000-memory.dmp

Download

memory/5048-307-0x0000000000A90000-0x0000000000B02000-memory.dmp

Download

memory/5048-304-0x0000000000A90000-0x0000000000B02000-memory.dmp

Download

memory/5048-314-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/5048-302-0x0000000076940000-0x0000000076B55000-memory.dmp

Download

memory/5048-325-0x000000006E780000-0x000000006E7CC000-memory.dmp

Download

memory/5048-298-0x0000000000BE0000-0x0000000000C24000-memory.dmp

Download

memory/5048-317-0x0000000005580000-0x0000000005742000-memory.dmp

Download

memory/5048-299-0x0000000000A90000-0x0000000000B02000-memory.dmp

Download

memory/5060-319-0x0000000005572000-0x0000000005573000-memory.dmp

Download

memory/5060-318-0x0000000005570000-0x0000000005571000-memory.dmp

Download