allcome | 463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe

Analysis

max time kernel
150s
max time network
149s
platform
windows10_x64
resource
win10-en-20211208
submitted
19-02-2022 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe
Size

4.5MB
MD5

22b96b68b4372ff2ce604723e9436963
SHA1

066ff406521cc2f0aed70414ee8d4d7751d0fe2a
SHA256

463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe
SHA512

0ecde5a89dd548cf16867c9a6c66c5b12f2b2e51920c1ab7cc1ff241f69a03116fe011aed2172c00cfe708c77856d5fe19d59b01a3880e3dfe38509a682d8a38

Score

10^/10

allcome redline @zexan infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

@Zexan

92.255.85.137:41320

Attributes

auth_value
da8092c88adbe82a93341dec420f0fa7

Extracted

Family

allcome

http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/Clipper/configure.php?cf6zrlhn=Rachel

Wallets

DCbpjBAroXBj3jrvq8HRPAKd8wYPnBwwi7

rKewCaU4Q6gqJnb5nJqkDY69QoxHKXAJZi

Xiem2Rw5LULbzv6rM49FqKAKD1nHSxpjxb

TZ3Pn82NBECik8ujtc3Wu5AVsQLCdt7cG1

t1Pxn7QZPAVhrsd2cdPHDEjDR1jtwpoUvbT

GDKPOPZWADWVDB2B743X7Q5QIMXIFJTIJ3K3JTR5P2EKO22GJQRAZRKC

497qdSyfY8t9dYnAGTnk8UigUbUPL4MXTFAxobWPDZ5rReSiVNL22GEGt9ptgNbDbTe3qyj3oRq2LfEYbws8yGqnSjBWHR6

qra53qtr5kvaye7gvf5algrre5h0w6harqxluum6kp

bc1q79xgc502sqzt4qz0jhr7lr7qdxkf2z006gym0l

0X9BD5F03363CA0231A32B3B36AE2CF01623E2D1FE

LcPqsR8yyzukNBgoKrq3pKEXV4rpuMeF91

ronin:09864801afc2b70c960366f4c8ad806fe9d6965d

ltc1qsdn52gjku7sts4r64fyqelqkfm789gvagglnaj

bc1q79xgc502sqzt4qz0jhr7lr7qdxkf2z006gym0l

Signatures

Allcome
A clipbanker that supports stealing different cryptocurrency wallets and payment forms.
stealer allcome
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3728-128-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 21 IoCs

pid	Process
1588	soska.exe
3796	bayden.exe
4020	RegHost.exe
3940	subst.exe
3164	RegHost.exe
336	RegHost.exe
2968	RegHost.exe
3208	RegHost.exe
1464	RegHost.exe
1700	RegHost.exe
3988	RegHost.exe
2372	RegHost.exe
3220	RegHost.exe
456	RegHost.exe
3868	RegHost.exe
972	RegHost.exe
3044	RegHost.exe
924	RegHost.exe
828	RegHost.exe
2340	RegHost.exe
388	RegHost.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	soska.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs

pid	Process
3756	bfsvc.exe
3756	bfsvc.exe
3208	bfsvc.exe
3208	bfsvc.exe
1340	bfsvc.exe
1340	bfsvc.exe
3592	bfsvc.exe
3592	bfsvc.exe
2212	bfsvc.exe
2212	bfsvc.exe
1384	bfsvc.exe
1384	bfsvc.exe
3052	bfsvc.exe
3052	bfsvc.exe
1808	bfsvc.exe
1808	bfsvc.exe
2412	bfsvc.exe
2412	bfsvc.exe
1960	bfsvc.exe
1960	bfsvc.exe
2732	bfsvc.exe
2732	bfsvc.exe
1968	bfsvc.exe
1968	bfsvc.exe
2128	bfsvc.exe
2128	bfsvc.exe
528	bfsvc.exe
528	bfsvc.exe
3956	bfsvc.exe
3956	bfsvc.exe
3756	bfsvc.exe
3756	bfsvc.exe
1932	bfsvc.exe
1932	bfsvc.exe
560	bfsvc.exe
560	bfsvc.exe
2032	bfsvc.exe
2032	bfsvc.exe

Suspicious use of SetThreadContext 39 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 3728	2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe	70
PID 1588 set thread context of 3756	1588	soska.exe	77
PID 1588 set thread context of 3056	1588	soska.exe	78
PID 4020 set thread context of 3208	4020	RegHost.exe	84
PID 4020 set thread context of 2568	4020	RegHost.exe	86
PID 3164 set thread context of 1340	3164	RegHost.exe	90
PID 3164 set thread context of 2368	3164	RegHost.exe	91
PID 336 set thread context of 3592	336	RegHost.exe	96
PID 336 set thread context of 1396	336	RegHost.exe	97
PID 2968 set thread context of 2212	2968	RegHost.exe	103
PID 2968 set thread context of 2576	2968	RegHost.exe	106
PID 3208 set thread context of 1384	3208	RegHost.exe	110
PID 3208 set thread context of 732	3208	RegHost.exe	112
PID 1464 set thread context of 3052	1464	RegHost.exe	116
PID 1464 set thread context of 2000	1464	RegHost.exe	117
PID 1700 set thread context of 1808	1700	RegHost.exe	122
PID 1700 set thread context of 3632	1700	RegHost.exe	124
PID 3988 set thread context of 2412	3988	RegHost.exe	128
PID 3988 set thread context of 1412	3988	RegHost.exe	130
PID 2372 set thread context of 1960	2372	RegHost.exe	134
PID 2372 set thread context of 3416	2372	RegHost.exe	136
PID 3220 set thread context of 2732	3220	RegHost.exe	140
PID 3220 set thread context of 3828	3220	RegHost.exe	141
PID 456 set thread context of 1968	456	RegHost.exe	146
PID 456 set thread context of 1784	456	RegHost.exe	147
PID 3868 set thread context of 2128	3868	RegHost.exe	152
PID 3868 set thread context of 2816	3868	RegHost.exe	153
PID 972 set thread context of 528	972	RegHost.exe	158
PID 972 set thread context of 3196	972	RegHost.exe	159
PID 3044 set thread context of 3956	3044	RegHost.exe	164
PID 3044 set thread context of 1464	3044	RegHost.exe	165
PID 924 set thread context of 3756	924	RegHost.exe	170
PID 924 set thread context of 2000	924	RegHost.exe	171
PID 828 set thread context of 1932	828	RegHost.exe	176
PID 828 set thread context of 3928	828	RegHost.exe	178
PID 2340 set thread context of 560	2340	RegHost.exe	182
PID 2340 set thread context of 676	2340	RegHost.exe	183
PID 388 set thread context of 2032	388	RegHost.exe	188
PID 388 set thread context of 2860	388	RegHost.exe	189

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe
2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe
3728	AppLaunch.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3056	explorer.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe
3940	subst.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 3728	2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe	70
PID 2412 wrote to memory of 3728	2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe	70
PID 2412 wrote to memory of 3728	2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe	70
PID 2412 wrote to memory of 3728	2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe	70
PID 2412 wrote to memory of 3728	2412	463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe	70
PID 3728 wrote to memory of 1588	3728	AppLaunch.exe	72
PID 3728 wrote to memory of 1588	3728	AppLaunch.exe	72
PID 3728 wrote to memory of 3796	3728	AppLaunch.exe	74
PID 3728 wrote to memory of 3796	3728	AppLaunch.exe	74
PID 3728 wrote to memory of 3796	3728	AppLaunch.exe	74
PID 3796 wrote to memory of 1220	3796	bayden.exe	75
PID 3796 wrote to memory of 1220	3796	bayden.exe	75
PID 3796 wrote to memory of 1220	3796	bayden.exe	75
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3756	1588	soska.exe	77
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 1588 wrote to memory of 3056	1588	soska.exe	78
PID 3056 wrote to memory of 4020	3056	explorer.exe	81
PID 3056 wrote to memory of 4020	3056	explorer.exe	81
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84
PID 4020 wrote to memory of 3208	4020	RegHost.exe	84

C:\Users\Admin\AppData\Local\Temp\463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe
"C:\Users\Admin\AppData\Local\Temp\463f4d8ebcbe894ce30c7d08f6e469d934399b7be6d208ccdddf319dfc57e6fe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\soska.exe
    "C:\Users\Admin\AppData\Local\Temp\soska.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3756
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4020
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3208
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        6⤵
        
        PID:2568
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3164
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        8⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1340
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        8⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:336
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        10⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3592
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        10⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2968
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        12⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2212
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        12⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3208
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        14⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1384
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        14⤵
        
        PID:732
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1464
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        16⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3052
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        16⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1700
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        18⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1808
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        18⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3988
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        20⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2412
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        20⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2372
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        22⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1960
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        22⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3220
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        24⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2732
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        24⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:456
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        26⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1968
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        26⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3868
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        28⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2128
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        28⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:972
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        30⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:528
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        30⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3044
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        32⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3956
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        32⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:924
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        34⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3756
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        34⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:828
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        36⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1932
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        36⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2340
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        38⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:560
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        38⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:388
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe -log 0 -ftime 60 -pool etc.2miners.com:1010 -wal 0x8C40cd0F96391e6afc8F91744843EFc210e6B95d -coin etc -worker platina
        40⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2032
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "None" "Microsoft%20Basic%20Display%20Adapter" "platina" "etc"
        40⤵
        
        PID:2860
- - C:\Users\Admin\AppData\Local\Temp\bayden.exe
    "C:\Users\Admin\AppData\Local\Temp\bayden.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
      4⤵
      Creates scheduled task(s)
      PID:1220

C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
C:\Users\Admin\AppData\Local\CrashDumps\subst.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-513-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/528-598-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/560-630-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/676-631-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/732-535-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/1340-510-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/1384-534-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/1396-519-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/1412-559-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/1464-607-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/1464-537-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/1588-485-0x00007FF638980000-0x00007FF639AA8000-memory.dmp

Filesize
17.2MB

Download
memory/1700-545-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/1784-583-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/1808-551-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/1932-622-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/1960-566-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/1968-582-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/2000-615-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2000-543-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2032-638-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/2128-590-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/2212-526-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/2368-512-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2372-561-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/2412-124-0x0000000000450000-0x00000000006D6000-memory.dmp

Filesize
2.5MB

Download
memory/2412-558-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/2412-121-0x0000000000400000-0x0000000000B54000-memory.dmp

Filesize
7.3MB

Download
memory/2412-120-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download
memory/2412-119-0x0000000000D20000-0x0000000000D21000-memory.dmp

Filesize
4KB

Download
memory/2412-126-0x0000000000401000-0x000000000041A000-memory.dmp

Filesize
100KB

Download
memory/2412-118-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/2412-117-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/2412-127-0x000000000041A000-0x000000000043E000-memory.dmp

Filesize
144KB

Download
memory/2412-115-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2412-116-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/2568-503-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2576-527-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2732-574-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/2816-591-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2860-639-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2968-521-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/3052-542-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3056-492-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3056-490-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3164-505-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/3196-599-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3208-529-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/3208-502-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3416-567-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3592-518-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3632-550-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3728-140-0x00000000095F0000-0x000000000962E000-memory.dmp

Filesize
248KB

Download
memory/3728-136-0x0000000009AF0000-0x000000000A0F6000-memory.dmp

Filesize
6.0MB

Download
memory/3728-204-0x000000000BA10000-0x000000000BF3C000-memory.dmp

Filesize
5.2MB

Download
memory/3728-203-0x000000000B310000-0x000000000B4D2000-memory.dmp

Filesize
1.8MB

Download
memory/3728-190-0x000000000AFF0000-0x000000000B040000-memory.dmp

Filesize
320KB

Download
memory/3728-128-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3728-153-0x000000000A5E0000-0x000000000A5FE000-memory.dmp

Filesize
120KB

Download
memory/3728-152-0x000000000ABA0000-0x000000000AC32000-memory.dmp

Filesize
584KB

Download
memory/3728-150-0x0000000009940000-0x00000000099A6000-memory.dmp

Filesize
408KB

Download
memory/3728-151-0x000000000A520000-0x000000000A596000-memory.dmp

Filesize
472KB

Download
memory/3728-137-0x000000007367E000-0x000000007367F000-memory.dmp

Filesize
4KB

Download
memory/3728-138-0x0000000009590000-0x00000000095A2000-memory.dmp

Filesize
72KB

Download
memory/3728-142-0x0000000009630000-0x000000000967B000-memory.dmp

Filesize
300KB

Download
memory/3728-139-0x00000000096C0000-0x00000000097CA000-memory.dmp

Filesize
1.0MB

Download
memory/3728-147-0x000000000A600000-0x000000000AAFE000-memory.dmp

Filesize
5.0MB

Download
memory/3728-141-0x00000000099C0000-0x00000000099C1000-memory.dmp

Filesize
4KB

Download
memory/3756-491-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3756-614-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3756-489-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3828-575-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3928-623-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/3956-606-0x0000000140000000-0x0000000140815000-memory.dmp

Filesize
8.1MB

Download
memory/3988-553-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download
memory/4020-497-0x00007FF663920000-0x00007FF664A48000-memory.dmp

Filesize
17.2MB

Download