redline | hxxps://cdn[.]discordapp[.]com/attachments/959549137727131751/975900099341353030/Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3[.]0[.]1[.]zip

General

Target

https://cdn.discordapp.com/attachments/959549137727131751/975900099341353030/Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1.zip

Score

10^/10

redline www infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

WWW

C2

107.175.65.144:41825

Attributes

auth_value
7d1bba8fb955acb1069ea8f3dc8b82d7

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2976-124-0x0000000000EA0000-0x0000000000EC0000-memory.dmp	family_redline

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 2 IoCs

Processes:

BTC Fake Transaction Full Version 3.0.1.exeBTC Fake Transaction Full Version 3.0.1.exe

description	pid	process	target process
PID 2084 set thread context of 2976	2084	BTC Fake Transaction Full Version 3.0.1.exe	BTC Fake Transaction Full Version 3.0.1.exe
PID 712 set thread context of 4384	712	BTC Fake Transaction Full Version 3.0.1.exe	BTC Fake Transaction Full Version 3.0.1.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exeBTC Fake Transaction Full Version 3.0.1.exeBTC Fake Transaction Full Version 3.0.1.exeBTC Fake Transaction Full Version 3.0.1.exe

pid	process
4764	chrome.exe
4764	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
3156	chrome.exe
3156	chrome.exe
5024	chrome.exe
5024	chrome.exe
4604	chrome.exe
4604	chrome.exe
4436	chrome.exe
4436	chrome.exe
652	chrome.exe
652	chrome.exe
548	chrome.exe
548	chrome.exe
3416	chrome.exe
3416	chrome.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
2084	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
2976	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe
712	BTC Fake Transaction Full Version 3.0.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

chrome.exe

pid process

4684 chrome.exe
4684 chrome.exe
4684 chrome.exe
4684 chrome.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

BTC Fake Transaction Full Version 3.0.1.exeBTC Fake Transaction Full Version 3.0.1.exeBTC Fake Transaction Full Version 3.0.1.exe

description	pid	process
Token: SeDebugPrivilege	2084	BTC Fake Transaction Full Version 3.0.1.exe
Token: SeDebugPrivilege	712	BTC Fake Transaction Full Version 3.0.1.exe
Token: SeDebugPrivilege	2976	BTC Fake Transaction Full Version 3.0.1.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

chrome.exe

pid	process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4684 wrote to memory of 4700	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4700	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4760	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4764	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4764	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe
PID 4684 wrote to memory of 4164	4684	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://cdn.discordapp.com/attachments/959549137727131751/975900099341353030/Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd6de34f50,0x7ffd6de34f60,0x7ffd6de34f70
2⤵
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1632 /prefetch:2
2⤵
PID:4760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1688 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2292 /prefetch:8
2⤵
PID:4164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
2⤵
PID:2752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:1
2⤵
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4052 /prefetch:8
2⤵
PID:4780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4116 /prefetch:8
2⤵
PID:5072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:8
2⤵
PID:3176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 /prefetch:8
2⤵
PID:3228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:8
2⤵
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5508 /prefetch:8
2⤵
PID:4080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
2⤵
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1356 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:548

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
2⤵
PID:620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2460 /prefetch:8
2⤵
PID:220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,2629900502600997386,17640341321804158039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 /prefetch:8
2⤵
PID:2832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1644

C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe
"C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe
"C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe
"C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe
"C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe"
2⤵
PID:4612

C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe
"C:\Users\Admin\Downloads\Btcoin_Fake_Transaction_Lightning_Network_Full_Version_3.0.1\Btcoin Fake Transaction v 3.0.1\BTC Fake Transaction Full Version 3.0.1.exe"
2⤵
PID:4384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
78KB

MD5
51fa50e628e3250ee32c399a6c3204c9

SHA1
1799e880c3db510e4d999f8259952ab77c9379e4

SHA256
5e8e149bee1f4c8a3f652277886193a047ed3bb1ce4198673f29cdb98f9dc315

SHA512
b7663aa702db8881500f33db9390c197e3038e01cc74019eda3c37745d805cecd1008f3dc48834acdd737ba88b42751694e6e07b850463bb93e1506b3ee0aff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BTC Fake Transaction Full Version 3.0.1.exe.log
Filesize
617B

MD5
4b1382f82cb506f36d30c01d5d515bca

SHA1
621aeafd1d115a27c71dd58c6211716c9640aba6

SHA256
d01a9a6d2f90166ffccd93ebf12c3ba6dd2ab12a9c047a6449d5968cc92d4200

SHA512
8700fd86011f3af3467ccb6c6d6c56f4004aada7a82186047dbba1cb01c3a2344213ecb1f1c67f3e20d269a79b0e61238b043a363047b050eecbd84bba4e65a5

Download Submit
\??\pipe\crashpad_4684_VLYJYVDWQJINRBER
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2084-118-0x0000000000BB0000-0x0000000000C5C000-memory.dmp

Filesize
688KB

Download
memory/2084-119-0x0000000004900000-0x000000000499C000-memory.dmp

Filesize
624KB

Download
memory/2084-120-0x0000000004860000-0x00000000048CC000-memory.dmp

Filesize
432KB

Download
memory/2084-121-0x0000000007560000-0x0000000007A5E000-memory.dmp

Filesize
5.0MB

Download
memory/2976-127-0x0000000009810000-0x000000000991A000-memory.dmp

Filesize
1.0MB

Download
memory/2976-131-0x0000000007B80000-0x0000000007BF6000-memory.dmp

Filesize
472KB

Download
memory/2976-126-0x0000000007F90000-0x0000000007FA2000-memory.dmp

Filesize
72KB

Download
memory/2976-124-0x0000000000EA0000-0x0000000000EC0000-memory.dmp

Filesize
128KB

Download
memory/2976-128-0x0000000009750000-0x000000000978E000-memory.dmp

Filesize
248KB

Download
memory/2976-129-0x0000000009790000-0x00000000097DB000-memory.dmp

Filesize
300KB

Download
memory/2976-130-0x000000000A430000-0x000000000A496000-memory.dmp

Filesize
408KB

Download
memory/2976-125-0x0000000007FB0000-0x00000000085B6000-memory.dmp

Filesize
6.0MB

Download
memory/2976-132-0x000000000A5A0000-0x000000000A632000-memory.dmp

Filesize
584KB

Download
memory/2976-133-0x0000000007CB0000-0x0000000007CCE000-memory.dmp

Filesize
120KB

Download
memory/2976-123-0x00000000004123FE-mapping.dmp

Download
memory/2976-135-0x000000000A910000-0x000000000AAD2000-memory.dmp

Filesize
1.8MB

Download
memory/2976-136-0x000000000B570000-0x000000000BA9C000-memory.dmp

Filesize
5.2MB

Download
memory/2976-122-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2976-140-0x000000000A8C0000-0x000000000A910000-memory.dmp

Filesize
320KB

Download
memory/4384-139-0x00000000004123FE-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads