phoenixstealer | 60c63fafcbcb2655d7806d9715f1755db205a975ddf68421967a39a2abcfb11a

Analysis

max time kernel
4294181s
max time network
140s
platform
windows7_x64
resource
win7-20220311-en
submitted
11-04-2022 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

4.5MB
MD5

f556df38b1abf7c5ef71b6bc040bfe93
SHA1

64a174173f3e4c46b8db36fa04f076dca5a3aac7
SHA256

60c63fafcbcb2655d7806d9715f1755db205a975ddf68421967a39a2abcfb11a
SHA512

0a74598fb4b4b256555c0e4b8e7b654cc0fcb6a18c16f9da912eeea4b24d79f66776e3484200277ff9705032ef60afca97639df4a273cedb2729d6dd085b598b

Score

10^/10

phoenixstealer redline infostealer spyware stealer

Malware Config

Extracted

Family

redline

104.244.76.137:4487

Attributes

auth_value
67c42657a2dc51f3323efd90a04a2b03

Signatures

PhoenixStealer
PhoenixStealer is an information stealer written in the C++, it sends the stolen information to cybercriminals.
stealer phoenixstealer
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1524-97-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1524-102-0x000000000041BCAE-mapping.dmp	family_redline
behavioral1/memory/1524-103-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral1/memory/1524-104-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1432	s.exe
1576	setup.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat	cmd.exe

Loads dropped DLL 12 IoCs

pid	Process
1892	1.exe
1892	1.exe
1892	1.exe
1892	1.exe
1892	1.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe
1328	WerFault.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 1524	1432	s.exe	34
PID 1576 set thread context of 648	1576	setup.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	1576	WerFault.exe	29

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2008	schtasks.exe
1236	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ac580c504dd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc000000000200000000001066000000010000200000005e27670704556a577898708b28a6a06c8a3020eef84c3dd36194d7482d25212a000000000e800000000200002000000047335c3fd8c69ea139378267e422dcad32aaa6407e8a1e798e7a859a5e72503d2000000040ac33a56bb0d663d978a8440bac44f66c84f02a697773f3d0f174190db4e0cd40000000665f9f91937d159d356f3935561a1ffe99eedd52ca5513711989ac791177b98a1ec53f090a0396ed3534f3b023573c994d0b2c58314c628d8e7987fe470a3724	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-bestprize.life\Total = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d8f8b5d2fcdd154fb512d53e64640bcc0000000002000000000010660000000100002000000017eb5e2797cf3cfdf2bd7c61b63b7085eb5ad1c395bdfe0b8679d90faae9ce63000000000e8000000002000020000000f1ebbc2d37f5676aa9d40b1613679acd8a44f4afb38db87695ea3d830390e433900000001b286bbf8de56c2802a1b8b53e8d381cde756327d23748d69553eeff8ad550d3def737f590f5673930c1072c02bcad3f7d40cb66a4977c308dbedffbdc51b14d20b6d543feb7942cd83d1102628febc2b177f4001a695722be5a65c61332bd75365120980c34d1c365026eb6fa6b1b92d0de1a461a863ef6f7131fa0bd2e0624a37d3b281127529c7757500190c19ec940000000007d10e8314395281d718835a33f9ca4e7d89de5474850f0e93323c2caa14b1f90743c7152e0eab04bc6c306ce32f7c91b39253fa1b236add7a3706b6010af14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-bestprize.life\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-bestprize.life\ = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F0A0AF1-B943-11EC-816E-EE3629CFC53B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-bestprize.life\Total = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-bestprize.life\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356410823"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-bestprize.life	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	setup.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1576	setup.exe
1332	powershell.exe
1524	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	setup.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1524	AppLaunch.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
944	IEXPLORE.EXE
944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1432	1892	1.exe	27
PID 1892 wrote to memory of 1432	1892	1.exe	27
PID 1892 wrote to memory of 1432	1892	1.exe	27
PID 1892 wrote to memory of 1432	1892	1.exe	27
PID 1892 wrote to memory of 1576	1892	1.exe	29
PID 1892 wrote to memory of 1576	1892	1.exe	29
PID 1892 wrote to memory of 1576	1892	1.exe	29
PID 1892 wrote to memory of 1576	1892	1.exe	29
PID 1892 wrote to memory of 2012	1892	1.exe	30
PID 1892 wrote to memory of 2012	1892	1.exe	30
PID 1892 wrote to memory of 2012	1892	1.exe	30
PID 1892 wrote to memory of 2012	1892	1.exe	30
PID 1892 wrote to memory of 1228	1892	1.exe	32
PID 1892 wrote to memory of 1228	1892	1.exe	32
PID 1892 wrote to memory of 1228	1892	1.exe	32
PID 1892 wrote to memory of 1228	1892	1.exe	32
PID 1228 wrote to memory of 1712	1228	cmd.exe	35
PID 1228 wrote to memory of 1712	1228	cmd.exe	35
PID 1228 wrote to memory of 1712	1228	cmd.exe	35
PID 1228 wrote to memory of 1712	1228	cmd.exe	35
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1432 wrote to memory of 1524	1432	s.exe	34
PID 1712 wrote to memory of 944	1712	iexplore.exe	37
PID 1712 wrote to memory of 944	1712	iexplore.exe	37
PID 1712 wrote to memory of 944	1712	iexplore.exe	37
PID 1712 wrote to memory of 944	1712	iexplore.exe	37
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 648	1576	setup.exe	38
PID 1576 wrote to memory of 1764	1576	setup.exe	39
PID 1576 wrote to memory of 1764	1576	setup.exe	39
PID 1576 wrote to memory of 1764	1576	setup.exe	39
PID 1576 wrote to memory of 2008	1576	setup.exe	40
PID 1576 wrote to memory of 2008	1576	setup.exe	40
PID 1576 wrote to memory of 2008	1576	setup.exe	40
PID 1576 wrote to memory of 1236	1576	setup.exe	43
PID 1576 wrote to memory of 1236	1576	setup.exe	43
PID 1576 wrote to memory of 1236	1576	setup.exe	43
PID 1576 wrote to memory of 1332	1576	setup.exe	45
PID 1576 wrote to memory of 1332	1576	setup.exe	45
PID 1576 wrote to memory of 1332	1576	setup.exe	45
PID 1576 wrote to memory of 1328	1576	setup.exe	48
PID 1576 wrote to memory of 1328	1576	setup.exe	48
PID 1576 wrote to memory of 1328	1576	setup.exe	48

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\Temp\s.exe
  "C:\Windows\Temp\s.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\Windows\Temp\setup.exe
  "C:\Windows\Temp\setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:648
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /delete /tn WindowsService /f
    3⤵
    PID:1764
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /tn WindowsService /tr "C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Service.exe" /sc onlogon /rl highest
    3⤵
    - Creates scheduled task(s)
    PID:2008
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn WindowsServiceUpload /tr "C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Service.exe" /f /rl highest
    3⤵
    - Creates scheduled task(s)
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Folder'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 1576 -s 1868
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\Temp\run.bat" "
  2⤵
  - Drops startup file
  PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Windows\Temp\lol.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://methodmedia.biz/?p=gmzgcobuge5gi3bpgu4dkmbz
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:944

C:\Windows\system32\taskeng.exe
taskeng.exe {7CBD1431-0760-42AB-969E-2B4493811327} S-1-5-21-2199625441-3471261906-229485034-1000:DRLQIXCW\Admin:Interactive:[1]
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99b3a5b4c94baef6e42f3021e0837405

SHA1
18932e631aab9de6cc087df841ca037b73794b5c

SHA256
c5183453a51511f178d8e5fe025ea803000416a687f033c8733cf4e93461b2c1

SHA512
26bca80934ed68c3bb69282f9701692d24f5bba960e6e96e2ca2f673fde4111c61d570bcc7c906a14c7cdea78cd99787c2e61fcfe1a821639ff98fb211f18fa5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T5B11CIP.txt

Filesize
602B

MD5
d7ac50c74d687905df46b8a126adb19d

SHA1
196110f691e46b7386e0f06e201f8eb715b11460

SHA256
dcdc5bef1c9e21ac8c069120ebe3ec811eda989912b42cd7263004ec212a32fc

SHA512
a08ac55c931f1e74af17815f2039a826ac959fc4a32df117c8f910cfd83f46f9dfb1042f9ee7ef0be10c35d84f70d6c1a5942800db10601ed06a647c6d77a084

Download Submit
C:\Windows\Temp\lol.bat

Filesize
62B

MD5
f95588de9545bb2369f424377a4c0289

SHA1
9e8e0876df2171cbca169e90965442f106cb0600

SHA256
70915616ff58efa0206685c04e9c3a1a02fc0a0e8a5396509552b1903d9c8097

SHA512
56d82f43863d181af70ce5b943ed9f23b1a18523cfc322cebce17a7f823ebf97420a2d38478fd4839bbcb1f9f659ad9bde965f7891e192b17dc4610e02b5b6f4

Download Submit
C:\Windows\Temp\run.bat

Filesize
98B

MD5
731afe244b2414169a5f630d52646e56

SHA1
e3771ccdccd8c306ee5fc4f264cfc3310690458c

SHA256
6c24e5b6a9aaced68f9f93581913bdea4cc1077060827d5d59d6680859e4e552

SHA512
84e0dc44ae3eadf6d31484119294126f5a056add94733fea2ba5597b6a302fc107117f5c5029d4ce0ff8e5c859c4de9c456aa5f01d420f25a3d56dc569801ff1

Download Submit
C:\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
C:\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
C:\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
\Windows\Temp\s.exe

Filesize
3.9MB

MD5
89864c831ebb2a57b104544ef4ad5bc5

SHA1
7b863625c47af7ae464223f531540e0a85a045f2

SHA256
bbae1e89d39bff79d315a5be1b7934223691883c16c3f7ad8cc2ea98b30824bb

SHA512
72e44af099372eac1134938f38bc9e19a026d603191e5d81c0a44a066f652a3e2cc71f5a75c1b16e4cc2f83d379cf5a7e293e7f47d6a8364b00e48e8fef028e2

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
\Windows\Temp\setup.exe

Filesize
968KB

MD5
92c419119e1a95da7d3ce5c85724872f

SHA1
494650fe4fdca8260cf48a006979d14c6a890c8b

SHA256
5fb5101940f2fa6e9145b664ef88b3cb3258cf8743dd1f13f76dd7bbdb652b96

SHA512
3d6699910ba9f466e940db1abf89ca7e88466f4f5ce3cd11ad7b2da3ad0fb1045e11f831d4766347a2b6b7959b7c00b0f93d8e7f4bf9b27e00bc17319f3da5b9

Download Submit
memory/648-118-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-115-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-133-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-125-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-111-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-110-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-117-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-113-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/648-120-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download
memory/1332-136-0x00000000023D2000-0x00000000023D4000-memory.dmp

Filesize
8KB

Download
memory/1332-145-0x00000000023DB000-0x00000000023FA000-memory.dmp

Filesize
124KB

Download
memory/1332-132-0x000007FEEB100000-0x000007FEEBC5D000-memory.dmp

Filesize
11.4MB

Download
memory/1332-137-0x00000000023D4000-0x00000000023D7000-memory.dmp

Filesize
12KB

Download
memory/1332-135-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/1332-131-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download
memory/1432-76-0x0000000000400000-0x0000000000AE0000-memory.dmp

Filesize
6.9MB

Download
memory/1524-97-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-104-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-103-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-95-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1576-109-0x0000000000150000-0x0000000000158000-memory.dmp

Filesize
32KB

Download
memory/1576-107-0x0000000000140000-0x0000000000148000-memory.dmp

Filesize
32KB

Download
memory/1576-108-0x0000000000740000-0x00000000007A6000-memory.dmp

Filesize
408KB

Download
memory/1576-70-0x00000000012E0000-0x0000000001300000-memory.dmp

Filesize
128KB

Download
memory/1576-106-0x000000001BDF0000-0x000000001BDF2000-memory.dmp

Filesize
8KB

Download
memory/1576-134-0x000000001BDF6000-0x000000001BE15000-memory.dmp

Filesize
124KB

Download
memory/1576-123-0x00000000008C0000-0x00000000008EC000-memory.dmp

Filesize
176KB

Download
memory/1892-54-0x0000000074FF1000-0x0000000074FF3000-memory.dmp

Filesize
8KB

Download