redline | a57a23a46090a1f301b6023fef51c92783314dbd152ddbe02a487de001ff0fef

Analysis

max time kernel
155s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2022 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

1.4MB
MD5

78f68a0fb5f0c24f041645df00699aec
SHA1

1a17d9a718205e6ea91e24968f992c1247f2e4e8
SHA256

a57a23a46090a1f301b6023fef51c92783314dbd152ddbe02a487de001ff0fef
SHA512

2bddb8e8278d45f37f3bb3ed1877c5eef3b04828503abca2993ad0a4cb83b49143bb73351e0c65174fbebede9172317dea9ddac3b21643c17370f5dc94826d23

Score

10^/10

redline xmrig ytstealer infostealer miner persistence spyware stealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
8a4b9f14d6658418ac4f4ee97fa35533

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/166012-133-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/166740-184-0x0000000000240000-0x0000000001019000-memory.dmp	family_ytstealer
behavioral2/memory/166740-214-0x0000000000240000-0x0000000001019000-memory.dmp	family_ytstealer

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
C:\ProgramData\Dllhost\winlogson.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

MainModule.exestart.execrypted.exedllhost.exewinlogson.exe

pid process

166436 MainModule.exe
166740 start.exe
166832 crypted.exe
2280 dllhost.exe
2324 winlogson.exe

pid	process
166436	MainModule.exe
166740	start.exe
166832	crypted.exe
2280	dllhost.exe
2324	winlogson.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\start.exe	upx
C:\Users\Admin\AppData\Local\Temp\start.exe	upx
behavioral2/memory/166740-165-0x0000000000240000-0x0000000001019000-memory.dmp	upx
behavioral2/memory/166740-184-0x0000000000240000-0x0000000001019000-memory.dmp	upx
behavioral2/memory/166740-214-0x0000000000240000-0x0000000001019000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

Loader.exe

description pid process target process

PID 3176 set thread context of 166012 3176 Loader.exe AppLaunch.exe
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4636 schtasks.exe
1324 schtasks.exe
1956 schtasks.exe
1136 schtasks.exe
1152 schtasks.exe
3912 schtasks.exe
720 schtasks.exe

description	pid	process	target process
PID 3176 set thread context of 166012	3176	Loader.exe	AppLaunch.exe

pid	process
4636	schtasks.exe
1324	schtasks.exe
1956	schtasks.exe
1136	schtasks.exe
1152	schtasks.exe
3912	schtasks.exe
720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeMainModule.exepowershell.exepowershell.exedllhost.exestart.exe

pid	process
166012	AppLaunch.exe
166436	MainModule.exe
166632	powershell.exe
166632	powershell.exe
1960	powershell.exe
2280	dllhost.exe
1960	powershell.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
166740	start.exe
166740	start.exe
166740	start.exe
166740	start.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe
2280	dllhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

652

pid	process
652

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

AppLaunch.exeMainModule.exepowershell.exepowershell.exedllhost.exewinlogson.exe

description	pid	process
Token: SeDebugPrivilege	166012	AppLaunch.exe
Token: SeDebugPrivilege	166436	MainModule.exe
Token: SeDebugPrivilege	166632	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	2280	dllhost.exe
Token: SeLockMemoryPrivilege	2324	winlogson.exe
Token: SeLockMemoryPrivilege	2324	winlogson.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

winlogson.exe

pid process

2324 winlogson.exe

pid	process
2324	winlogson.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Loader.exeAppLaunch.exeMainModule.execmd.exedllhost.exe

description	pid	process	target process
PID 3176 wrote to memory of 166012	3176	Loader.exe	AppLaunch.exe
PID 3176 wrote to memory of 166012	3176	Loader.exe	AppLaunch.exe
PID 3176 wrote to memory of 166012	3176	Loader.exe	AppLaunch.exe
PID 3176 wrote to memory of 166012	3176	Loader.exe	AppLaunch.exe
PID 3176 wrote to memory of 166012	3176	Loader.exe	AppLaunch.exe
PID 166012 wrote to memory of 166436	166012	AppLaunch.exe	MainModule.exe
PID 166012 wrote to memory of 166436	166012	AppLaunch.exe	MainModule.exe
PID 166012 wrote to memory of 166436	166012	AppLaunch.exe	MainModule.exe
PID 166436 wrote to memory of 166560	166436	MainModule.exe	cmd.exe
PID 166436 wrote to memory of 166560	166436	MainModule.exe	cmd.exe
PID 166436 wrote to memory of 166560	166436	MainModule.exe	cmd.exe
PID 166560 wrote to memory of 166612	166560	cmd.exe	chcp.com
PID 166560 wrote to memory of 166612	166560	cmd.exe	chcp.com
PID 166560 wrote to memory of 166612	166560	cmd.exe	chcp.com
PID 166560 wrote to memory of 166632	166560	cmd.exe	powershell.exe
PID 166560 wrote to memory of 166632	166560	cmd.exe	powershell.exe
PID 166560 wrote to memory of 166632	166560	cmd.exe	powershell.exe
PID 166012 wrote to memory of 166740	166012	AppLaunch.exe	start.exe
PID 166012 wrote to memory of 166740	166012	AppLaunch.exe	start.exe
PID 166012 wrote to memory of 166832	166012	AppLaunch.exe	crypted.exe
PID 166012 wrote to memory of 166832	166012	AppLaunch.exe	crypted.exe
PID 166012 wrote to memory of 166832	166012	AppLaunch.exe	crypted.exe
PID 166436 wrote to memory of 2280	166436	MainModule.exe	dllhost.exe
PID 166436 wrote to memory of 2280	166436	MainModule.exe	dllhost.exe
PID 166436 wrote to memory of 2280	166436	MainModule.exe	dllhost.exe
PID 166560 wrote to memory of 1960	166560	cmd.exe	powershell.exe
PID 166560 wrote to memory of 1960	166560	cmd.exe	powershell.exe
PID 166560 wrote to memory of 1960	166560	cmd.exe	powershell.exe
PID 2280 wrote to memory of 2688	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2688	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2688	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4900	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4900	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4900	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4928	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4928	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4928	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2024	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2024	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2024	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2192	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2192	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2192	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 5004	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 5004	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 5004	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2012	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2012	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 2012	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 5084	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 5084	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 5084	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4368	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4368	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4368	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 3844	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 3844	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 3844	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4536	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4536	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 4536	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 1248	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 1248	2280	dllhost.exe	cmd.exe
PID 2280 wrote to memory of 1248	2280	dllhost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:166012
- - C:\Users\Admin\AppData\Local\Temp\MainModule.exe
    "C:\Users\Admin\AppData\Local\Temp\MainModule.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:166436
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:166560
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:166612
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:166632
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1960
  - - C:\ProgramData\Dllhost\dllhost.exe
      "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2688
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4900
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2024
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:4636
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2192
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:5004
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1324
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4928
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:720
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:5084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9836" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:3844
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4846" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4368
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4846" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1152
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6980" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4536
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6980" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:1136
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2698" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:1248
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk2698" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        5⤵
        
        PID:2340
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        5⤵
        
        PID:3820
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:3772
      - C:\ProgramData\Dllhost\winlogson.exe
        
        C:\ProgramData\Dllhost\winlogson.exe -c config.json
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2324
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:166740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\start.exe
      4⤵
      PID:2996
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:4312
- - C:\Users\Admin\AppData\Local\Temp\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\crypted.exe"
    3⤵
    - Executes dropped EXE
    PID:166832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
953KB

MD5
7dadec75c72d9ca68ad351b147ce82d7

SHA1
258718e852b80a293ea8505b2946190dcb3cd806

SHA256
12deb4d3b58a9102ba0a9493ce1e2ea38a57a50214e1da4261b1e2b3d7f5539a

SHA512
655e72a33457425b08592b7db8ab62ed232114355079de20fca23535e69e59bef13e971f48af83a382070abbb7620499b32bd8da5ad6b79f0e5f8502266ccf0d

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
953KB

MD5
7dadec75c72d9ca68ad351b147ce82d7

SHA1
258718e852b80a293ea8505b2946190dcb3cd806

SHA256
12deb4d3b58a9102ba0a9493ce1e2ea38a57a50214e1da4261b1e2b3d7f5539a

SHA512
655e72a33457425b08592b7db8ab62ed232114355079de20fca23535e69e59bef13e971f48af83a382070abbb7620499b32bd8da5ad6b79f0e5f8502266ccf0d

Download Submit
C:\ProgramData\Dllhost\winlogson.exe

Filesize
7.9MB

MD5
ae6c92c8073b1239390369d3ed93538f

SHA1
a76ea83bdcfa472cd593363e9bb254df494a5577

SHA256
d8d0e8ce7d532250713c7ac9c3e3d144463ce9f47bbf5bd6fc3bb939c739c1a0

SHA512
59de08ea3849243addb3b6aaa2b3ebf71a271eee77239bea0dd190d446a6eec56fd7c5b4fa3668c14074f33f06ab1f011baa0ac2266f6d2d33eb59847841c350

Download Submit
C:\ProgramData\SystemFiles\config.json

Filesize
312B

MD5
3fd684964005aab765878c363f801709

SHA1
c9b70db2d5b0dae35122c167c5976c1e8460724a

SHA256
79a2f32ae67fce5aecafa7413fb4ba1534e6ad6f98ec5e2bfced5af824846a54

SHA512
f9e83aa7c34a7f40f300e8fbdbe7b01b0f230a2956f0697473aaa87ae574c9c17561855480e0edfe8a6c9cfa7681226c28db0314ade3e50902e759c784d4cf8f

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin

Filesize
1KB

MD5
0135fad955fc63c0bda02c79738bde6d

SHA1
5d0e42e685510b0cdac4922444879761df721ed2

SHA256
2b6400b92aa887cf003ed65eb7b9906051872e4056ba7ab31cb77812435f6792

SHA512
cf4fd82a90095f9b8259380d8f80fbf5b116925068c898d016cda6a9c4a194a8733261a67e99f18d8f6262c62d36c2d1f98c9dccdf60140918e960d369e757fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c02435d60a024de08318dc859662aec8

SHA1
c59a42210599bbe2b1dc1930731189eff7b4a369

SHA256
6b11b7fcc9b920f6069980b8adc674c52512835cc87a079502202a36e86cde5d

SHA512
2e83b1e4ac02795bdb3772c295662fbc87f9bbbdb363482577d65cd124fe8af32624e47efb214b0eccd4c2785f27718704d7e309af17d9451cf29208324b0b09

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
memory/720-199-0x0000000000000000-mapping.dmp

Download
memory/1136-204-0x0000000000000000-mapping.dmp

Download
memory/1152-205-0x0000000000000000-mapping.dmp

Download
memory/1248-198-0x0000000000000000-mapping.dmp

Download
memory/1324-203-0x0000000000000000-mapping.dmp

Download
memory/1956-202-0x0000000000000000-mapping.dmp

Download
memory/1960-208-0x000000006DFB0000-0x000000006DFFC000-memory.dmp

Filesize
304KB

Download
memory/1960-185-0x0000000000000000-mapping.dmp

Download
memory/2012-193-0x0000000000000000-mapping.dmp

Download
memory/2024-190-0x0000000000000000-mapping.dmp

Download
memory/2192-191-0x0000000000000000-mapping.dmp

Download
memory/2280-183-0x00000000008C0000-0x00000000009B4000-memory.dmp

Filesize
976KB

Download
memory/2280-180-0x0000000000000000-mapping.dmp

Download
memory/2324-221-0x00000194009E0000-0x0000019400A00000-memory.dmp

Filesize
128KB

Download
memory/2324-222-0x0000019400A00000-0x0000019400A20000-memory.dmp

Filesize
128KB

Download
memory/2324-217-0x0000000000000000-mapping.dmp

Download
memory/2324-219-0x0000019400990000-0x00000194009B0000-memory.dmp

Filesize
128KB

Download
memory/2340-209-0x0000000000000000-mapping.dmp

Download
memory/2688-187-0x0000000000000000-mapping.dmp

Download
memory/2996-212-0x0000000000000000-mapping.dmp

Download
memory/3772-216-0x0000000000000000-mapping.dmp

Download
memory/3820-215-0x0000000000000000-mapping.dmp

Download
memory/3844-196-0x0000000000000000-mapping.dmp

Download
memory/3912-206-0x0000000000000000-mapping.dmp

Download
memory/4312-213-0x0000000000000000-mapping.dmp

Download
memory/4368-195-0x0000000000000000-mapping.dmp

Download
memory/4536-197-0x0000000000000000-mapping.dmp

Download
memory/4636-200-0x0000000000000000-mapping.dmp

Download
memory/4900-188-0x0000000000000000-mapping.dmp

Download
memory/4928-189-0x0000000000000000-mapping.dmp

Download
memory/5004-192-0x0000000000000000-mapping.dmp

Download
memory/5084-194-0x0000000000000000-mapping.dmp

Download
memory/166012-147-0x0000000008F60000-0x0000000008FB0000-memory.dmp

Filesize
320KB

Download
memory/166012-149-0x0000000009980000-0x0000000009EAC000-memory.dmp

Filesize
5.2MB

Download
memory/166012-144-0x0000000008960000-0x0000000008F04000-memory.dmp

Filesize
5.6MB

Download
memory/166012-146-0x0000000008690000-0x00000000086F6000-memory.dmp

Filesize
408KB

Download
memory/166012-143-0x0000000008310000-0x00000000083A2000-memory.dmp

Filesize
584KB

Download
memory/166012-142-0x00000000081F0000-0x0000000008266000-memory.dmp

Filesize
472KB

Download
memory/166012-148-0x0000000009280000-0x0000000009442000-memory.dmp

Filesize
1.8MB

Download
memory/166012-141-0x0000000007840000-0x000000000787C000-memory.dmp

Filesize
240KB

Download
memory/166012-140-0x00000000063A0000-0x00000000064AA000-memory.dmp

Filesize
1.0MB

Download
memory/166012-145-0x00000000082F0000-0x000000000830E000-memory.dmp

Filesize
120KB

Download
memory/166012-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/166012-132-0x0000000000000000-mapping.dmp

Download
memory/166012-139-0x00000000057F0000-0x0000000005802000-memory.dmp

Filesize
72KB

Download
memory/166012-138-0x0000000005D80000-0x0000000006398000-memory.dmp

Filesize
6.1MB

Download
memory/166436-154-0x000000000A090000-0x000000000A09A000-memory.dmp

Filesize
40KB

Download
memory/166436-153-0x0000000000320000-0x0000000000338000-memory.dmp

Filesize
96KB

Download
memory/166436-150-0x0000000000000000-mapping.dmp

Download
memory/166560-155-0x0000000000000000-mapping.dmp

Download
memory/166612-156-0x0000000000000000-mapping.dmp

Download
memory/166632-157-0x0000000000000000-mapping.dmp

Download
memory/166632-166-0x0000000006440000-0x000000000645E000-memory.dmp

Filesize
120KB

Download
memory/166632-179-0x00000000079E0000-0x00000000079E8000-memory.dmp

Filesize
32KB

Download
memory/166632-178-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Filesize
104KB

Download
memory/166632-177-0x00000000079A0000-0x00000000079AE000-memory.dmp

Filesize
56KB

Download
memory/166632-176-0x00000000079F0000-0x0000000007A86000-memory.dmp

Filesize
600KB

Download
memory/166632-175-0x00000000077C0000-0x00000000077CA000-memory.dmp

Filesize
40KB

Download
memory/166632-174-0x0000000007770000-0x000000000778A000-memory.dmp

Filesize
104KB

Download
memory/166632-173-0x0000000007DD0000-0x000000000844A000-memory.dmp

Filesize
6.5MB

Download
memory/166632-172-0x00000000069E0000-0x00000000069FE000-memory.dmp

Filesize
120KB

Download
memory/166632-158-0x0000000004E60000-0x0000000004E96000-memory.dmp

Filesize
216KB

Download
memory/166632-159-0x0000000005590000-0x0000000005BB8000-memory.dmp

Filesize
6.2MB

Download
memory/166632-171-0x000000006DFB0000-0x000000006DFFC000-memory.dmp

Filesize
304KB

Download
memory/166632-170-0x0000000006A00000-0x0000000006A32000-memory.dmp

Filesize
200KB

Download
memory/166632-160-0x00000000054F0000-0x0000000005512000-memory.dmp

Filesize
136KB

Download
memory/166632-161-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/166740-184-0x0000000000240000-0x0000000001019000-memory.dmp

Filesize
13.8MB

Download
memory/166740-165-0x0000000000240000-0x0000000001019000-memory.dmp

Filesize
13.8MB

Download
memory/166740-162-0x0000000000000000-mapping.dmp

Download
memory/166740-214-0x0000000000240000-0x0000000001019000-memory.dmp

Filesize
13.8MB

Download
memory/166832-167-0x0000000000000000-mapping.dmp

Download
memory/166832-211-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download
memory/166832-210-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download