onlylogger | 38066ee9fea009a8a6c2575e1a05fadd49a2cfe205dd8a6604eea85f5c7a42bd

Analysis

max time kernel
22s
max time network
151s
platform
windows7_x64
resource
win7-en-20211208
submitted
22/01/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8728dd1eeffcc3e1fc073e23fa81d05.exe
Size 9.5MB
Sample220122-jsn1tsadbn
SHA256 38066ee9fea009a8a6c2575e1a05fadd49a2cfe205dd8a6604eea85f5c7a42bd
MD5 a8728dd1eeffcc3e1fc073e23fa81d05
SHA1 de9a04bb02a531451d335b1eb8f752db42a21050
SHA512 13fe0666bed41ba9efb67f87656187380e2cc2694e6fb6094e08e961a50f3fe096f48f75a5b0a9dcec268b738195275b7cf094a30b9826ee26fbf6a9be0b2103
MD5 SHA1 SHA512

Score

10^/10

onlylogger redline smokeloader socelars vidar 915 media23nps v3user1 aspackv2 backdoor infostealer loader stealer suricata trojan

Malware Config

Extracted

Family

socelars

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.2

Botnet

https://mstdn.social/@kipriauk9
https://qoto.org/@kipriauk8

Attributes

profile_id
915

Extracted

Family

redline

Botnet

media23nps

65.108.69.168:13293

Extracted

Family

redline

Botnet

v3user1

159.69.246.184:13127

Extracted

Family

smokeloader

Version

2020

http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/

rc4.i32

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2552	rundll32.exe	74

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2076-242-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1620-243-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000600000001266d-84.dat	family_socelars
behavioral1/files/0x000600000001266d-106.dat	family_socelars
behavioral1/files/0x000600000001266d-104.dat	family_socelars

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/files/0x0006000000013302-94.dat	WebBrowserPassView

Nirsoft 2 IoCs

resource	yara_rule
behavioral1/files/0x0006000000013302-94.dat	Nirsoft
behavioral1/memory/2256-194-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft

OnlyLogger Payload 2 IoCs

resource	yara_rule
behavioral1/memory/268-164-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger
behavioral1/memory/268-181-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1768-226-0x0000000000400000-0x0000000000885000-memory.dmp	family_vidar
behavioral1/memory/1768-227-0x0000000002350000-0x0000000002425000-memory.dmp	family_vidar

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00070000000125b9-64.dat	aspack_v212_v242
behavioral1/files/0x00070000000125b9-63.dat	aspack_v212_v242
behavioral1/files/0x000600000001261b-62.dat	aspack_v212_v242
behavioral1/files/0x000600000001261b-61.dat	aspack_v212_v242
behavioral1/files/0x000600000001262d-68.dat	aspack_v212_v242
behavioral1/files/0x000600000001262d-67.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 21 IoCs

pid	Process
1152	setup_install.exe
592	Tue0848b90bb9199c2.exe
1048	Tue08238fa411f1.exe
1044	Tue085e9f1c02.exe
1656	Tue086f918cd9.exe
1768	Tue087f053d8e2f2d.exe
1744	Tue0864b842a46.exe
1728	Tue08d0bbc6369.exe
524	Tue08682a4df1.exe
1668	Tue08a2e2fc8a08f07.exe
1072	Tue08682a4df1.exe
1976	Tue08f97ee0ff.exe
960	Tue089ef00fcf131b.exe
1512	Tue08e828d674bf.exe
1508	Tue08fa5b32dd5408.exe
2032	Tue085d5a130cd8c6.exe
1688	Tue08a16da484cb2699.exe
268	Tue08e828d674bf.exe
1144	Tue085d5a130cd8c6.tmp
2132	Tue085d5a130cd8c6.exe
2212	Tue085d5a130cd8c6.tmp

Loads dropped DLL 64 IoCs

pid	Process
1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe
1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe
1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe
1152	setup_install.exe
1152	setup_install.exe
1152	setup_install.exe
1152	setup_install.exe
1152	setup_install.exe
1152	setup_install.exe
1152	setup_install.exe
1152	setup_install.exe
1948	cmd.exe
1552	cmd.exe
1060	cmd.exe
1212	cmd.exe
1212	cmd.exe
1824	cmd.exe
1824	cmd.exe
1860	cmd.exe
1464	cmd.exe
984	cmd.exe
984	cmd.exe
1728	Tue08d0bbc6369.exe
1728	Tue08d0bbc6369.exe
804	cmd.exe
804	cmd.exe
1044	Tue085e9f1c02.exe
1044	Tue085e9f1c02.exe
524	Tue08682a4df1.exe
524	Tue08682a4df1.exe
1668	Tue08a2e2fc8a08f07.exe
1668	Tue08a2e2fc8a08f07.exe
524	Tue08682a4df1.exe
1196	cmd.exe
1736	cmd.exe
1736	cmd.exe
1072	Tue08682a4df1.exe
1072	Tue08682a4df1.exe
1632	cmd.exe
1632	cmd.exe
1608	cmd.exe
1652	cmd.exe
860	cmd.exe
860	cmd.exe
1656	Tue086f918cd9.exe
1656	Tue086f918cd9.exe
1976	Tue08f97ee0ff.exe
1976	Tue08f97ee0ff.exe
1768	Tue087f053d8e2f2d.exe
1768	Tue087f053d8e2f2d.exe
1512	Tue08e828d674bf.exe
1512	Tue08e828d674bf.exe
1688	Tue08a16da484cb2699.exe
1688	Tue08a16da484cb2699.exe
960	Tue089ef00fcf131b.exe
960	Tue089ef00fcf131b.exe
2032	Tue085d5a130cd8c6.exe
2032	Tue085d5a130cd8c6.exe
1512	Tue08e828d674bf.exe
268	Tue08e828d674bf.exe
268	Tue08e828d674bf.exe
2032	Tue085d5a130cd8c6.exe
1144	Tue085d5a130cd8c6.tmp
1144	Tue085d5a130cd8c6.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
43	ipinfo.io
44	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
960	Tue089ef00fcf131b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 268	1512	Tue08e828d674bf.exe	64

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2612	268	WerFault.exe	64
2932	1728	WerFault.exe	53

Kills process with taskkill 1 IoCs

evasion

pid	Process
2684	taskkill.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
960	Tue089ef00fcf131b.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeAssignPrimaryTokenPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeLockMemoryPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeIncreaseQuotaPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeMachineAccountPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeTcbPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeSecurityPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeTakeOwnershipPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeLoadDriverPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeSystemProfilePrivilege	592	Tue0848b90bb9199c2.exe
Token: SeSystemtimePrivilege	592	Tue0848b90bb9199c2.exe
Token: SeProfSingleProcessPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeIncBasePriorityPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeCreatePagefilePrivilege	592	Tue0848b90bb9199c2.exe
Token: SeCreatePermanentPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeBackupPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeRestorePrivilege	592	Tue0848b90bb9199c2.exe
Token: SeShutdownPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeDebugPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeAuditPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeSystemEnvironmentPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeChangeNotifyPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeRemoteShutdownPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeUndockPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeSyncAgentPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeEnableDelegationPrivilege	592	Tue0848b90bb9199c2.exe
Token: SeManageVolumePrivilege	592	Tue0848b90bb9199c2.exe
Token: SeImpersonatePrivilege	592	Tue0848b90bb9199c2.exe
Token: SeCreateGlobalPrivilege	592	Tue0848b90bb9199c2.exe
Token: 31	592	Tue0848b90bb9199c2.exe
Token: 32	592	Tue0848b90bb9199c2.exe
Token: 33	592	Tue0848b90bb9199c2.exe
Token: 34	592	Tue0848b90bb9199c2.exe
Token: 35	592	Tue0848b90bb9199c2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1144 wrote to memory of 1152	1144	a8728dd1eeffcc3e1fc073e23fa81d05.exe	27
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1864	1152	setup_install.exe	29
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1596	1152	setup_install.exe	30
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1948	1152	setup_install.exe	31
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1060	1152	setup_install.exe	32
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1824	1152	setup_install.exe	36
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1552	1152	setup_install.exe	35
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1212	1152	setup_install.exe	34
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1608	1152	setup_install.exe	33
PID 1152 wrote to memory of 1652	1152	setup_install.exe	46

C:\Users\Admin\AppData\Local\Temp\a8728dd1eeffcc3e1fc073e23fa81d05.exe
"C:\Users\Admin\AppData\Local\Temp\a8728dd1eeffcc3e1fc073e23fa81d05.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
    3⤵
    PID:1864
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0848b90bb9199c2.exe
    3⤵
    - Loads dropped DLL
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue0848b90bb9199c2.exe
      Tue0848b90bb9199c2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:592
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:2636
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue085e9f1c02.exe
    3⤵
    - Loads dropped DLL
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue085e9f1c02.exe
      Tue085e9f1c02.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1044
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /U .\WEZZo.U~0 /S
        5⤵
        
        PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08fa5b32dd5408.exe
    3⤵
    - Loads dropped DLL
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08fa5b32dd5408.exe
      Tue08fa5b32dd5408.exe
      4⤵
      Executes dropped EXE
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:2256
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue086f918cd9.exe
    3⤵
    - Loads dropped DLL
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue086f918cd9.exe
      Tue086f918cd9.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08238fa411f1.exe
    3⤵
    - Loads dropped DLL
    PID:1552
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08238fa411f1.exe
      Tue08238fa411f1.exe
      4⤵
      Executes dropped EXE
      PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue087f053d8e2f2d.exe
    3⤵
    - Loads dropped DLL
    PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue087f053d8e2f2d.exe
      Tue087f053d8e2f2d.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08e828d674bf.exe /mixtwo
    3⤵
    - Loads dropped DLL
    PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08e828d674bf.exe
      Tue08e828d674bf.exe /mixtwo
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08e828d674bf.exe
        
        Tue08e828d674bf.exe /mixtwo
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:268
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 268 -s 468
        6⤵
        Program crash
        
        PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08a2e2fc8a08f07.exe
    3⤵
    - Loads dropped DLL
    PID:804
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08a2e2fc8a08f07.exe
      Tue08a2e2fc8a08f07.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1668
    - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08a2e2fc8a08f07.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08a2e2fc8a08f07.exe
        5⤵
        
        PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue089ef00fcf131b.exe
    3⤵
    - Loads dropped DLL
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue089ef00fcf131b.exe
      Tue089ef00fcf131b.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08d0bbc6369.exe
    3⤵
    - Loads dropped DLL
    PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08d0bbc6369.exe
      Tue08d0bbc6369.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1728
    - - C:\Users\Admin\Pictures\Adobe Films\ZeZQ9NRenoU6JFpTPsfim37P.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\ZeZQ9NRenoU6JFpTPsfim37P.exe"
        5⤵
        
        PID:2712
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 1496
        5⤵
        Program crash
        
        PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08a16da484cb2699.exe
    3⤵
    - Loads dropped DLL
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08a16da484cb2699.exe
      Tue08a16da484cb2699.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08a16da484cb2699.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08a16da484cb2699.exe
        5⤵
        
        PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0864b842a46.exe
    3⤵
    - Loads dropped DLL
    PID:1860
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue0864b842a46.exe
      Tue0864b842a46.exe
      4⤵
      Executes dropped EXE
      PID:1744
    - - C:\Users\Admin\AppData\Local\4ab38e9d-511c-427d-be8c-72312065467b.exe
        
        "C:\Users\Admin\AppData\Local\4ab38e9d-511c-427d-be8c-72312065467b.exe"
        5⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\7abbfc5b-2ea1-4df1-b93e-c5cef08bd51f.exe
        
        "C:\Users\Admin\AppData\Local\7abbfc5b-2ea1-4df1-b93e-c5cef08bd51f.exe"
        5⤵
        
        PID:2704
      - C:\Users\Admin\AppData\Roaming\87703005\8770288287702882.exe
        
        "C:\Users\Admin\AppData\Roaming\87703005\8770288287702882.exe"
        6⤵
        
        PID:616
    - - C:\Users\Admin\AppData\Local\8cb34af5-d659-4d78-8bc5-6f3ad9a7208b.exe
        
        "C:\Users\Admin\AppData\Local\8cb34af5-d659-4d78-8bc5-6f3ad9a7208b.exe"
        5⤵
        
        PID:456
      - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8cb34af5-d659-4d78-8bc5-6f3ad9a7208b.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        6⤵
        
        PID:1164
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
        7⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\538e7c0d-0f7e-446d-af90-110d23cf3c39.exe
        
        "C:\Users\Admin\AppData\Local\538e7c0d-0f7e-446d-af90-110d23cf3c39.exe"
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Roaming\6384996.exe
        
        "C:\Users\Admin\AppData\Roaming\6384996.exe"
        6⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s QtGUM.8Qe -u
        7⤵
        
        PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08682a4df1.exe
    3⤵
    - Loads dropped DLL
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08682a4df1.exe
      Tue08682a4df1.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08682a4df1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08682a4df1.exe" -u
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08f97ee0ff.exe
    3⤵
    - Loads dropped DLL
    PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue08f97ee0ff.exe
      Tue08f97ee0ff.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1976
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /U .\WEZZo.U~0 /S
        5⤵
        
        PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue085d5a130cd8c6.exe
    3⤵
    - Loads dropped DLL
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue085d5a130cd8c6.exe
      Tue085d5a130cd8c6.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\is-OFG7G.tmp\Tue085d5a130cd8c6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-OFG7G.tmp\Tue085d5a130cd8c6.tmp" /SL5="$101AA,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue085d5a130cd8c6.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue085d5a130cd8c6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue085d5a130cd8c6.exe" /SILENT
        6⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\is-HB70F.tmp\Tue085d5a130cd8c6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HB70F.tmp\Tue085d5a130cd8c6.tmp" /SL5="$201AA,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS87404BC5\Tue085d5a130cd8c6.exe" /SILENT
        7⤵
        Executes dropped EXE
        
        PID:2212

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:2728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-181-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/268-164-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/268-162-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/308-203-0x0000000001F30000-0x0000000002B7A000-memory.dmp

Download

memory/308-212-0x0000000001F30000-0x0000000002B7A000-memory.dmp

Download

memory/456-259-0x0000000000790000-0x00000000007D5000-memory.dmp

Download

memory/616-269-0x0000000000880000-0x00000000008AA000-memory.dmp

Download

memory/616-277-0x000000001B260000-0x000000001B262000-memory.dmp

Download

memory/960-185-0x0000000074E50000-0x0000000074E97000-memory.dmp

Download

memory/960-180-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/960-187-0x0000000075B50000-0x0000000075CAC000-memory.dmp

Download

memory/960-179-0x0000000076490000-0x000000007653C000-memory.dmp

Download

memory/960-178-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/960-177-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/960-176-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/960-173-0x0000000000120000-0x0000000000165000-memory.dmp

Download

memory/960-165-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/960-172-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/960-175-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/960-174-0x0000000001260000-0x000000000181D000-memory.dmp

Download

memory/1048-156-0x0000000000CC0000-0x0000000000CC8000-memory.dmp

Download

memory/1048-222-0x000000001AA40000-0x000000001AA42000-memory.dmp

Download

memory/1144-188-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1144-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Download

memory/1152-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1152-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1152-75-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1152-166-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1152-81-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1152-163-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1152-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1152-74-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1152-161-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1152-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1152-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1152-168-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1412-282-0x0000000002220000-0x0000000002236000-memory.dmp

Download

memory/1620-244-0x0000000000370000-0x00000000003FC000-memory.dmp

Download

memory/1620-243-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1656-278-0x00000000001D0000-0x00000000001D8000-memory.dmp

Download

memory/1656-279-0x00000000001E0000-0x00000000001E9000-memory.dmp

Download

memory/1656-280-0x0000000000400000-0x0000000000812000-memory.dmp

Download

memory/1668-216-0x0000000000370000-0x00000000003D0000-memory.dmp

Download

memory/1668-214-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/1668-207-0x00000000010A0000-0x000000000112C000-memory.dmp

Download

memory/1688-215-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/1688-213-0x0000000000060000-0x00000000000EC000-memory.dmp

Download

memory/1688-217-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/1692-271-0x0000000000420000-0x0000000000452000-memory.dmp

Download

memory/1692-262-0x00000000002D0000-0x000000000031A000-memory.dmp

Download

memory/1692-267-0x0000000000220000-0x0000000000226000-memory.dmp

Download

memory/1692-274-0x00000000049B0000-0x00000000049B1000-memory.dmp

Download

memory/1692-272-0x0000000000230000-0x0000000000236000-memory.dmp

Download

memory/1728-220-0x0000000003F40000-0x00000000040FD000-memory.dmp

Download

memory/1768-225-0x0000000000320000-0x000000000039C000-memory.dmp

Download

memory/1768-226-0x0000000000400000-0x0000000000885000-memory.dmp

Download

memory/1768-227-0x0000000002350000-0x0000000002425000-memory.dmp

Download

memory/1936-205-0x0000000002260000-0x0000000002EAA000-memory.dmp

Download

memory/1936-210-0x0000000002260000-0x0000000002EAA000-memory.dmp

Download

memory/1936-208-0x0000000002260000-0x0000000002EAA000-memory.dmp

Download

memory/2032-169-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/2076-242-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2076-245-0x0000000004C30000-0x0000000004C31000-memory.dmp

Download

memory/2132-190-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/2212-202-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/2256-194-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/2400-289-0x000000002CEB0000-0x000000002CF67000-memory.dmp

Download

memory/2400-288-0x0000000000D20000-0x0000000000ED9000-memory.dmp

Download

memory/2588-247-0x00000000008B0000-0x00000000008FC000-memory.dmp

Download

memory/2588-248-0x0000000000430000-0x0000000000436000-memory.dmp

Download

memory/2588-249-0x00000000006A0000-0x00000000006EE000-memory.dmp

Download

memory/2588-250-0x00000000003E0000-0x00000000003E6000-memory.dmp

Download

memory/2588-255-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/2612-228-0x00000000003C0000-0x00000000003C1000-memory.dmp

Download

memory/2704-254-0x00000000004F0000-0x000000000050C000-memory.dmp

Download

memory/2704-251-0x0000000000E50000-0x0000000000E7A000-memory.dmp

Download

memory/2704-261-0x0000000000510000-0x0000000000516000-memory.dmp

Download

memory/2704-252-0x00000000004E0000-0x00000000004E6000-memory.dmp

Download

memory/2932-229-0x0000000000420000-0x0000000000421000-memory.dmp

Download