onlylogger | 38066ee9fea009a8a6c2575e1a05fadd49a2cfe205dd8a6604eea85f5c7a42bd

Analysis

max time kernel
10s
max time network
155s
platform
windows10_x64
resource
win10-en-20211208
submitted
22/01/2022, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8728dd1eeffcc3e1fc073e23fa81d05.exe
Size 9.5MB
Sample220122-jsn1tsadbn
SHA256 38066ee9fea009a8a6c2575e1a05fadd49a2cfe205dd8a6604eea85f5c7a42bd
MD5 a8728dd1eeffcc3e1fc073e23fa81d05
SHA1 de9a04bb02a531451d335b1eb8f752db42a21050
SHA512 13fe0666bed41ba9efb67f87656187380e2cc2694e6fb6094e08e961a50f3fe096f48f75a5b0a9dcec268b738195275b7cf094a30b9826ee26fbf6a9be0b2103
MD5 SHA1 SHA512

Score

10^/10

onlylogger raccoon redline socelars 8fc55a7ea41b0c5db2ca3c881e20966100c28a40 media23nps v3user1 aspackv2 infostealer loader spyware stealer suricata

Malware Config

Extracted

Family

socelars

http://www.biohazardgraphics.com/

Extracted

Family

raccoon

rc4.plain

Extracted

Family

raccoon

Botnet

8fc55a7ea41b0c5db2ca3c881e20966100c28a40

Attributes

url4cnc
http://194.180.174.53/jredmankun

http://91.219.236.18/jredmankun

http://194.180.174.41/jredmankun

http://91.219.236.148/jredmankun

https://t.me/jredmankun

rc4.plain

Extracted

Family

redline

Botnet

v3user1

159.69.246.184:13127

Extracted

Family

redline

Botnet

media23nps

65.108.69.168:13293

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	1180	rundll32.exe	124

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

resource	yara_rule
behavioral2/memory/3768-251-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/1352-282-0x0000000000260000-0x00000000002D2000-memory.dmp	family_redline
behavioral2/memory/1352-288-0x0000000000260000-0x00000000002D2000-memory.dmp	family_redline
behavioral2/memory/1592-254-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/4772-1214-0x0000000000AC0000-0x0000000000B3F000-memory.dmp	family_redline

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab30-138.dat	family_socelars
behavioral2/files/0x000500000001ab30-174.dat	family_socelars

suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/files/0x000500000001ab3d-143.dat	WebBrowserPassView
behavioral2/files/0x000500000001ab3d-159.dat	WebBrowserPassView
behavioral2/files/0x000800000001ab1f-247.dat	WebBrowserPassView
behavioral2/memory/680-248-0x0000000000400000-0x000000000047C000-memory.dmp	WebBrowserPassView
behavioral2/files/0x000800000001ab1f-250.dat	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab3d-143.dat	Nirsoft
behavioral2/files/0x000500000001ab3d-159.dat	Nirsoft
behavioral2/memory/3012-208-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/files/0x000700000001ab1f-207.dat	Nirsoft
behavioral2/files/0x000700000001ab1f-206.dat	Nirsoft
behavioral2/files/0x000800000001ab1f-247.dat	Nirsoft
behavioral2/memory/680-248-0x0000000000400000-0x000000000047C000-memory.dmp	Nirsoft
behavioral2/files/0x000800000001ab1f-250.dat	Nirsoft

OnlyLogger Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2904-180-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger
behavioral2/memory/2904-228-0x0000000000400000-0x0000000000450000-memory.dmp	family_onlylogger

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001ab2a-121.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab29-122.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab2a-124.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab29-123.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab2c-126.dat	aspack_v212_v242
behavioral2/files/0x000500000001ab2c-129.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 20 IoCs

pid	Process
3552	setup_install.exe
1800	Tue08a2e2fc8a08f07.exe
3660	Tue087f053d8e2f2d.exe
1136	Tue086f918cd9.exe
924	Tue08238fa411f1.exe
4072	Tue08e828d674bf.exe
1012	Tue08a16da484cb2699.exe
1424	Tue08fa5b32dd5408.exe
912	Tue08f97ee0ff.exe
1812	Tue08d0bbc6369.exe
1772	Tue085d5a130cd8c6.tmp
2332	Tue0864b842a46.exe
3588	Tue085d5a130cd8c6.exe
1580	Tue0848b90bb9199c2.exe
2156	Tue089ef00fcf131b.exe
764	Tue085e9f1c02.exe
2904	Tue08e828d674bf.exe
3980	Tue08682a4df1.exe
2664	Tue085d5a130cd8c6.tmp
3012	11111.exe

Loads dropped DLL 6 IoCs

pid	Process
3552	setup_install.exe
3552	setup_install.exe
3552	setup_install.exe
3552	setup_install.exe
3552	setup_install.exe
3552	setup_install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
67	api.db-ip.com
11	ip-api.com
61	ipinfo.io
63	ipinfo.io
66	api.db-ip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2156	Tue089ef00fcf131b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4072 set thread context of 2904	4072	Tue08e828d674bf.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4820	2904	WerFault.exe	105

Kills process with taskkill 1 IoCs

evasion

pid	Process
716	taskkill.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	Tue08238fa411f1.exe
Token: SeCreateTokenPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeAssignPrimaryTokenPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeLockMemoryPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeIncreaseQuotaPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeMachineAccountPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeTcbPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeSecurityPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeTakeOwnershipPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeLoadDriverPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeSystemProfilePrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeSystemtimePrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeProfSingleProcessPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeIncBasePriorityPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeCreatePagefilePrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeCreatePermanentPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeBackupPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeRestorePrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeShutdownPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeDebugPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeAuditPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeSystemEnvironmentPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeChangeNotifyPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeRemoteShutdownPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeUndockPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeSyncAgentPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeEnableDelegationPrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeManageVolumePrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeImpersonatePrivilege	1580	Tue0848b90bb9199c2.exe
Token: SeCreateGlobalPrivilege	1580	Tue0848b90bb9199c2.exe
Token: 31	1580	Tue0848b90bb9199c2.exe
Token: 32	1580	Tue0848b90bb9199c2.exe
Token: 33	1580	Tue0848b90bb9199c2.exe
Token: 34	1580	Tue0848b90bb9199c2.exe
Token: 35	1580	Tue0848b90bb9199c2.exe
Token: SeDebugPrivilege	2332	Tue0864b842a46.exe
Token: SeDebugPrivilege	1012	Tue08a16da484cb2699.exe
Token: SeDebugPrivilege	1800	Tue08a2e2fc8a08f07.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3552	2700	a8728dd1eeffcc3e1fc073e23fa81d05.exe	69
PID 2700 wrote to memory of 3552	2700	a8728dd1eeffcc3e1fc073e23fa81d05.exe	69
PID 2700 wrote to memory of 3552	2700	a8728dd1eeffcc3e1fc073e23fa81d05.exe	69
PID 3552 wrote to memory of 2804	3552	setup_install.exe	73
PID 3552 wrote to memory of 2804	3552	setup_install.exe	73
PID 3552 wrote to memory of 2804	3552	setup_install.exe	73
PID 3552 wrote to memory of 1536	3552	setup_install.exe	72
PID 3552 wrote to memory of 1536	3552	setup_install.exe	72
PID 3552 wrote to memory of 1536	3552	setup_install.exe	72
PID 3552 wrote to memory of 4088	3552	setup_install.exe	76
PID 3552 wrote to memory of 4088	3552	setup_install.exe	76
PID 3552 wrote to memory of 4088	3552	setup_install.exe	76
PID 3552 wrote to memory of 4092	3552	setup_install.exe	75
PID 3552 wrote to memory of 4092	3552	setup_install.exe	75
PID 3552 wrote to memory of 4092	3552	setup_install.exe	75
PID 3552 wrote to memory of 8	3552	setup_install.exe	74
PID 3552 wrote to memory of 8	3552	setup_install.exe	74
PID 3552 wrote to memory of 8	3552	setup_install.exe	74
PID 3552 wrote to memory of 1896	3552	setup_install.exe	88
PID 3552 wrote to memory of 1896	3552	setup_install.exe	88
PID 3552 wrote to memory of 1896	3552	setup_install.exe	88
PID 3552 wrote to memory of 956	3552	setup_install.exe	87
PID 3552 wrote to memory of 956	3552	setup_install.exe	87
PID 3552 wrote to memory of 956	3552	setup_install.exe	87
PID 3552 wrote to memory of 788	3552	setup_install.exe	86
PID 3552 wrote to memory of 788	3552	setup_install.exe	86
PID 3552 wrote to memory of 788	3552	setup_install.exe	86
PID 3552 wrote to memory of 3544	3552	setup_install.exe	85
PID 3552 wrote to memory of 3544	3552	setup_install.exe	85
PID 3552 wrote to memory of 3544	3552	setup_install.exe	85
PID 3552 wrote to memory of 1028	3552	setup_install.exe	84
PID 3552 wrote to memory of 1028	3552	setup_install.exe	84
PID 3552 wrote to memory of 1028	3552	setup_install.exe	84
PID 3552 wrote to memory of 648	3552	setup_install.exe	83
PID 3552 wrote to memory of 648	3552	setup_install.exe	83
PID 3552 wrote to memory of 648	3552	setup_install.exe	83
PID 3552 wrote to memory of 1300	3552	setup_install.exe	82
PID 3552 wrote to memory of 1300	3552	setup_install.exe	82
PID 3552 wrote to memory of 1300	3552	setup_install.exe	82
PID 3552 wrote to memory of 1352	3552	setup_install.exe	81
PID 3552 wrote to memory of 1352	3552	setup_install.exe	81
PID 3552 wrote to memory of 1352	3552	setup_install.exe	81
PID 3552 wrote to memory of 3172	3552	setup_install.exe	80
PID 3552 wrote to memory of 3172	3552	setup_install.exe	80
PID 3552 wrote to memory of 3172	3552	setup_install.exe	80
PID 3552 wrote to memory of 1096	3552	setup_install.exe	79
PID 3552 wrote to memory of 1096	3552	setup_install.exe	79
PID 3552 wrote to memory of 1096	3552	setup_install.exe	79
PID 3552 wrote to memory of 404	3552	setup_install.exe	78
PID 3552 wrote to memory of 404	3552	setup_install.exe	78
PID 3552 wrote to memory of 404	3552	setup_install.exe	78
PID 3552 wrote to memory of 2032	3552	setup_install.exe	77
PID 3552 wrote to memory of 2032	3552	setup_install.exe	77
PID 3552 wrote to memory of 2032	3552	setup_install.exe	77
PID 2804 wrote to memory of 3248	2804	cmd.exe	90
PID 2804 wrote to memory of 3248	2804	cmd.exe	90
PID 2804 wrote to memory of 3248	2804	cmd.exe	90
PID 1536 wrote to memory of 408	1536	cmd.exe	89
PID 1536 wrote to memory of 408	1536	cmd.exe	89
PID 1536 wrote to memory of 408	1536	cmd.exe	89
PID 404 wrote to memory of 1800	404	cmd.exe	92
PID 404 wrote to memory of 1800	404	cmd.exe	92
PID 404 wrote to memory of 1800	404	cmd.exe	92
PID 8 wrote to memory of 3660	8	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\a8728dd1eeffcc3e1fc073e23fa81d05.exe
"C:\Users\Admin\AppData\Local\Temp\a8728dd1eeffcc3e1fc073e23fa81d05.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\setup_install.exe
  "C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\setup_install.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
      4⤵
      PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue087f053d8e2f2d.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue087f053d8e2f2d.exe
      Tue087f053d8e2f2d.exe
      4⤵
      Executes dropped EXE
      PID:3660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue085e9f1c02.exe
    3⤵
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue085e9f1c02.exe
      Tue085e9f1c02.exe
      4⤵
      Executes dropped EXE
      PID:764
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /U .\WEZZo.U~0 /S
        5⤵
        
        PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0848b90bb9199c2.exe
    3⤵
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue0848b90bb9199c2.exe
      Tue0848b90bb9199c2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1580
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:4228
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08e828d674bf.exe /mixtwo
    3⤵
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08e828d674bf.exe
      Tue08e828d674bf.exe /mixtwo
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08e828d674bf.exe
        
        Tue08e828d674bf.exe /mixtwo
        5⤵
        Executes dropped EXE
        
        PID:2904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 808
        6⤵
        Program crash
        
        PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08a2e2fc8a08f07.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:404
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08a2e2fc8a08f07.exe
      Tue08a2e2fc8a08f07.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08a2e2fc8a08f07.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08a2e2fc8a08f07.exe
        5⤵
        
        PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue089ef00fcf131b.exe
    3⤵
    PID:1096
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue089ef00fcf131b.exe
      Tue089ef00fcf131b.exe
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08d0bbc6369.exe
    3⤵
    PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08d0bbc6369.exe
      Tue08d0bbc6369.exe
      4⤵
      Executes dropped EXE
      PID:1812
    - - C:\Users\Admin\Pictures\Adobe Films\gGZuPk_Q6UBSVXegIiPwRQyn.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gGZuPk_Q6UBSVXegIiPwRQyn.exe"
        5⤵
        
        PID:4800
    - - C:\Users\Admin\Pictures\Adobe Films\8J5HymH37XcNSqCs_I9pTRdE.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8J5HymH37XcNSqCs_I9pTRdE.exe"
        5⤵
        
        PID:2136
    - - C:\Users\Admin\Pictures\Adobe Films\E4wqlIj3E__Zdyf9ObXVyOtf.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\E4wqlIj3E__Zdyf9ObXVyOtf.exe"
        5⤵
        
        PID:4804
    - - C:\Users\Admin\Pictures\Adobe Films\8suz2bKwsu2UN9KbTTQ2zTXV.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\8suz2bKwsu2UN9KbTTQ2zTXV.exe"
        5⤵
        
        PID:2500
    - - C:\Users\Admin\Pictures\Adobe Films\CFYI6Cc4tTIcO5sZx5LDvisC.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\CFYI6Cc4tTIcO5sZx5LDvisC.exe"
        5⤵
        
        PID:4772
    - - C:\Users\Admin\Pictures\Adobe Films\rw6oV9iVMpVWGbuFebfC8Rb4.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\rw6oV9iVMpVWGbuFebfC8Rb4.exe"
        5⤵
        
        PID:2672
    - - C:\Users\Admin\Pictures\Adobe Films\WLwpNxNiW_xWk1WsIHgFKaHN.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\WLwpNxNiW_xWk1WsIHgFKaHN.exe"
        5⤵
        
        PID:3728
    - - C:\Users\Admin\Pictures\Adobe Films\gJ0ErDog0D3xS8cjZU_g5wWm.exe
        
        "C:\Users\Admin\Pictures\Adobe Films\gJ0ErDog0D3xS8cjZU_g5wWm.exe"
        5⤵
        
        PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08a16da484cb2699.exe
    3⤵
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08a16da484cb2699.exe
      Tue08a16da484cb2699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08a16da484cb2699.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08a16da484cb2699.exe
        5⤵
        
        PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue0864b842a46.exe
    3⤵
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue0864b842a46.exe
      Tue0864b842a46.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2332
    - - C:\Users\Admin\AppData\Local\b5b8a2cf-397a-4d2e-b671-86c42d3a8f36.exe
        
        "C:\Users\Admin\AppData\Local\b5b8a2cf-397a-4d2e-b671-86c42d3a8f36.exe"
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\fe37405c-fd8c-4f22-a105-9aaeedbee009.exe
        
        "C:\Users\Admin\AppData\Local\fe37405c-fd8c-4f22-a105-9aaeedbee009.exe"
        5⤵
        
        PID:2360
      - C:\Users\Admin\AppData\Roaming\84508859\5211488052114880.exe
        
        "C:\Users\Admin\AppData\Roaming\84508859\5211488052114880.exe"
        6⤵
        
        PID:4640
    - - C:\Users\Admin\AppData\Local\1232d0e5-8538-43c2-8c73-5bc7e77242a5.exe
        
        "C:\Users\Admin\AppData\Local\1232d0e5-8538-43c2-8c73-5bc7e77242a5.exe"
        5⤵
        
        PID:1352
    - - C:\Users\Admin\AppData\Local\f48f02e2-c9fd-4032-b361-6bffd1476f57.exe
        
        "C:\Users\Admin\AppData\Local\f48f02e2-c9fd-4032-b361-6bffd1476f57.exe"
        5⤵
        
        PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08682a4df1.exe
    3⤵
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08682a4df1.exe
      Tue08682a4df1.exe
      4⤵
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08682a4df1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08682a4df1.exe" -u
        5⤵
        Executes dropped EXE
        
        PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08f97ee0ff.exe
    3⤵
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08f97ee0ff.exe
      Tue08f97ee0ff.exe
      4⤵
      Executes dropped EXE
      PID:912
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /U .\WEZZo.U~0 /S
        5⤵
        
        PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue085d5a130cd8c6.exe
    3⤵
    PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue085d5a130cd8c6.exe
      Tue085d5a130cd8c6.exe
      4⤵
      Executes dropped EXE
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\is-G3OKA.tmp\Tue085d5a130cd8c6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-G3OKA.tmp\Tue085d5a130cd8c6.tmp" /SL5="$6007E,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue085d5a130cd8c6.exe"
        5⤵
        Executes dropped EXE
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue085d5a130cd8c6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue085d5a130cd8c6.exe" /SILENT
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\is-7OQVG.tmp\Tue085d5a130cd8c6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-7OQVG.tmp\Tue085d5a130cd8c6.tmp" /SL5="$20210,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue085d5a130cd8c6.exe" /SILENT
        7⤵
        Executes dropped EXE
        
        PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08fa5b32dd5408.exe
    3⤵
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08fa5b32dd5408.exe
      Tue08fa5b32dd5408.exe
      4⤵
      Executes dropped EXE
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        Executes dropped EXE
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue086f918cd9.exe
    3⤵
    PID:956
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue086f918cd9.exe
      Tue086f918cd9.exe
      4⤵
      Executes dropped EXE
      PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Tue08238fa411f1.exe
    3⤵
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\7zSC8A58285\Tue08238fa411f1.exe
      Tue08238fa411f1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:924

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-196-0x0000000005030000-0x0000000005066000-memory.dmp

Download

memory/408-276-0x0000000007E20000-0x0000000007E3C000-memory.dmp

Download

memory/408-217-0x0000000004FC0000-0x0000000004FE3000-memory.dmp

Download

memory/408-201-0x00000000076D0000-0x0000000007CF8000-memory.dmp

Download

memory/408-225-0x0000000007D80000-0x0000000007DA2000-memory.dmp

Download

memory/408-203-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/680-248-0x0000000000400000-0x000000000047C000-memory.dmp

Download

memory/924-162-0x0000000000E80000-0x0000000000E88000-memory.dmp

Download

memory/924-221-0x000000001B9E0000-0x000000001B9E2000-memory.dmp

Download

memory/1012-235-0x00000000060F0000-0x00000000065EE000-memory.dmp

Download

memory/1012-209-0x0000000005840000-0x00000000058B6000-memory.dmp

Download

memory/1012-205-0x00000000057A0000-0x0000000005900000-memory.dmp

Download

memory/1012-220-0x00000000057A0000-0x0000000005900000-memory.dmp

Download

memory/1012-189-0x0000000000FD0000-0x000000000105C000-memory.dmp

Download

memory/1352-283-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/1352-325-0x000000006F6D0000-0x000000006F71B000-memory.dmp

Download

memory/1352-288-0x0000000000260000-0x00000000002D2000-memory.dmp

Download

memory/1352-291-0x00000000701F0000-0x0000000070270000-memory.dmp

Download

memory/1352-287-0x0000000074070000-0x0000000074161000-memory.dmp

Download

memory/1352-285-0x0000000076B10000-0x0000000076CD2000-memory.dmp

Download

memory/1352-282-0x0000000000260000-0x00000000002D2000-memory.dmp

Download

memory/1352-301-0x00000000757C0000-0x0000000076B08000-memory.dmp

Download

memory/1352-304-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Download

memory/1352-280-0x0000000000950000-0x0000000000995000-memory.dmp

Download

memory/1352-296-0x0000000074190000-0x0000000074714000-memory.dmp

Download

memory/1592-263-0x0000000004D10000-0x0000000005316000-memory.dmp

Download

memory/1592-279-0x0000000004F60000-0x0000000004FAB000-memory.dmp

Download

memory/1592-254-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1592-259-0x0000000004FE0000-0x00000000050EA000-memory.dmp

Download

memory/1620-237-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/1772-260-0x00000000007B0000-0x00000000008FA000-memory.dmp

Download

memory/1800-212-0x0000000005280000-0x000000000529E000-memory.dmp

Download

memory/1800-186-0x0000000000A20000-0x0000000000AAC000-memory.dmp

Download

memory/1800-244-0x0000000001210000-0x0000000001211000-memory.dmp

Download

memory/1800-243-0x0000000005260000-0x0000000005320000-memory.dmp

Download

memory/2156-230-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-218-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-215-0x0000000074070000-0x0000000074161000-memory.dmp

Download

memory/2156-213-0x0000000076B10000-0x0000000076CD2000-memory.dmp

Download

memory/2156-222-0x0000000002870000-0x00000000028B5000-memory.dmp

Download

memory/2156-199-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-223-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-232-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-224-0x0000000076F30000-0x00000000770BE000-memory.dmp

Download

memory/2156-211-0x0000000000C40000-0x0000000000C41000-memory.dmp

Download

memory/2156-229-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-226-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-246-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-194-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-249-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-202-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-219-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-184-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2156-204-0x0000000000270000-0x000000000082D000-memory.dmp

Download

memory/2332-210-0x000000001B6D0000-0x000000001B6D2000-memory.dmp

Download

memory/2332-179-0x0000000000A90000-0x0000000000AC4000-memory.dmp

Download

memory/2332-188-0x0000000000BF0000-0x0000000000BF6000-memory.dmp

Download

memory/2360-277-0x0000000000440000-0x000000000046A000-memory.dmp

Download

memory/2360-303-0x0000000000A80000-0x0000000000A86000-memory.dmp

Download

memory/2360-284-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/2360-294-0x0000000000A60000-0x0000000000A7C000-memory.dmp

Download

memory/2664-245-0x00000000007D0000-0x000000000091A000-memory.dmp

Download

memory/2904-180-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/2904-228-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3012-208-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/3208-274-0x00000000047F0000-0x000000002F1D9000-memory.dmp

Download

memory/3248-231-0x00000000080B0000-0x0000000008116000-memory.dmp

Download

memory/3248-240-0x0000000005200000-0x00000000073E0000-memory.dmp

Download

memory/3248-233-0x0000000007900000-0x0000000007966000-memory.dmp

Download

memory/3248-216-0x0000000005200000-0x00000000073E0000-memory.dmp

Download

memory/3248-239-0x0000000008300000-0x0000000008650000-memory.dmp

Download

memory/3268-281-0x00000000029C0000-0x00000000029C6000-memory.dmp

Download

memory/3268-271-0x0000000000770000-0x00000000007BC000-memory.dmp

Download

memory/3268-289-0x0000000004F40000-0x0000000004F8E000-memory.dmp

Download

memory/3268-293-0x0000000004A70000-0x0000000004A76000-memory.dmp

Download

memory/3268-292-0x000000000DA20000-0x000000000DAB2000-memory.dmp

Download

memory/3268-308-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/3552-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3552-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3552-195-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3552-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3552-137-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3552-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/3552-193-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/3552-197-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3552-200-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/3552-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3552-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3552-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/3588-182-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3660-362-0x0000000000BF0000-0x0000000000C6C000-memory.dmp

Download

memory/3768-258-0x0000000004EA0000-0x0000000004EB2000-memory.dmp

Download

memory/3768-266-0x0000000004F00000-0x0000000004F3E000-memory.dmp

Download

memory/3768-255-0x0000000005350000-0x0000000005956000-memory.dmp

Download

memory/3768-251-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3768-264-0x0000000004D40000-0x0000000005346000-memory.dmp

Download

memory/4124-295-0x0000000002650000-0x0000000002682000-memory.dmp

Download

memory/4124-298-0x0000000000D80000-0x0000000000D86000-memory.dmp

Download

memory/4124-290-0x0000000000D70000-0x0000000000D76000-memory.dmp

Download

memory/4124-286-0x0000000000620000-0x000000000066A000-memory.dmp

Download

memory/4772-1219-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/4772-1214-0x0000000000AC0000-0x0000000000B3F000-memory.dmp

Download

memory/4772-1228-0x0000000076B10000-0x0000000076CD2000-memory.dmp

Download

memory/4772-1233-0x0000000074070000-0x0000000074161000-memory.dmp

Download

memory/4772-1244-0x00000000701F0000-0x0000000070270000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads