redline | 847cdb293e5ebd178f6a96bf6ab1d42a19a8e1fe7f95cd7858e6c06f9383fa3c

Analysis

max time kernel
164s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
28/07/2022, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fortnite Hack.exe
Size

1.2MB
MD5

55b26a60484194685f548c1c9fd4a688
SHA1

13f143a185813088b5f504b0ea0062ba8f4d414e
SHA256

847cdb293e5ebd178f6a96bf6ab1d42a19a8e1fe7f95cd7858e6c06f9383fa3c
SHA512

56d1f66f0cf9aaa5b59443708a4e6924f6c9719f78a672f871c1ec03509a89d219fa65e36078752c493b18849003ff24fffe0fadc0462147bcc0b915ef2a4494

Score

10^/10

redline xmrig ytstealer infostealer miner persistence spyware stealer upx

Malware Config

Extracted

Family

redline

62.204.41.141:24758

Attributes

auth_value
b60ab0a77cd51a54dec9018aa7c54ea1

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/166408-131-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/1660-156-0x00000000004B0000-0x0000000001289000-memory.dmp	family_ytstealer
behavioral2/memory/1660-171-0x00000000004B0000-0x0000000001289000-memory.dmp	family_ytstealer
behavioral2/memory/1660-216-0x00000000004B0000-0x0000000001289000-memory.dmp	family_ytstealer

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/files/0x00060000000232b0-221.dat	xmrig

Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
3756	MainModule.exe
1660	start.exe
2976	crypted.exe
3148	dllhost.exe
5996	winlogson.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022e9e-154.dat	upx
behavioral2/files/0x0006000000022e9e-155.dat	upx
behavioral2/memory/1660-156-0x00000000004B0000-0x0000000001289000-memory.dmp	upx
behavioral2/memory/1660-171-0x00000000004B0000-0x0000000001289000-memory.dmp	upx
behavioral2/memory/1660-216-0x00000000004B0000-0x0000000001289000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1524 set thread context of 166408	1524	Fortnite Hack.exe	84

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5248	schtasks.exe
5232	schtasks.exe
5276	schtasks.exe
5264	schtasks.exe
5224	schtasks.exe
5316	schtasks.exe
5308	schtasks.exe
5300	schtasks.exe
5292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
166408	AppLaunch.exe
3756	MainModule.exe
2232	powershell.exe
2232	powershell.exe
1896	powershell.exe
1896	powershell.exe
636	powershell.exe
636	powershell.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
1660	start.exe
1660	start.exe
1660	start.exe
1660	start.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe
3148	dllhost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	166408	AppLaunch.exe
Token: SeDebugPrivilege	3756	MainModule.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	3148	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 166408	1524	Fortnite Hack.exe	84
PID 1524 wrote to memory of 166408	1524	Fortnite Hack.exe	84
PID 1524 wrote to memory of 166408	1524	Fortnite Hack.exe	84
PID 1524 wrote to memory of 166408	1524	Fortnite Hack.exe	84
PID 1524 wrote to memory of 166408	1524	Fortnite Hack.exe	84
PID 166408 wrote to memory of 3756	166408	AppLaunch.exe	93
PID 166408 wrote to memory of 3756	166408	AppLaunch.exe	93
PID 166408 wrote to memory of 3756	166408	AppLaunch.exe	93
PID 166408 wrote to memory of 1660	166408	AppLaunch.exe	96
PID 166408 wrote to memory of 1660	166408	AppLaunch.exe	96
PID 166408 wrote to memory of 2976	166408	AppLaunch.exe	97
PID 166408 wrote to memory of 2976	166408	AppLaunch.exe	97
PID 166408 wrote to memory of 2976	166408	AppLaunch.exe	97
PID 3756 wrote to memory of 3120	3756	MainModule.exe	98
PID 3756 wrote to memory of 3120	3756	MainModule.exe	98
PID 3756 wrote to memory of 3120	3756	MainModule.exe	98
PID 3120 wrote to memory of 384	3120	cmd.exe	100
PID 3120 wrote to memory of 384	3120	cmd.exe	100
PID 3120 wrote to memory of 384	3120	cmd.exe	100
PID 3120 wrote to memory of 2232	3120	cmd.exe	101
PID 3120 wrote to memory of 2232	3120	cmd.exe	101
PID 3120 wrote to memory of 2232	3120	cmd.exe	101
PID 3120 wrote to memory of 1896	3120	cmd.exe	103
PID 3120 wrote to memory of 1896	3120	cmd.exe	103
PID 3120 wrote to memory of 1896	3120	cmd.exe	103
PID 3120 wrote to memory of 636	3120	cmd.exe	104
PID 3120 wrote to memory of 636	3120	cmd.exe	104
PID 3120 wrote to memory of 636	3120	cmd.exe	104
PID 3756 wrote to memory of 3148	3756	MainModule.exe	105
PID 3756 wrote to memory of 3148	3756	MainModule.exe	105
PID 3756 wrote to memory of 3148	3756	MainModule.exe	105
PID 3148 wrote to memory of 4728	3148	dllhost.exe	106
PID 3148 wrote to memory of 4728	3148	dllhost.exe	106
PID 3148 wrote to memory of 4728	3148	dllhost.exe	106
PID 3148 wrote to memory of 800	3148	dllhost.exe	107
PID 3148 wrote to memory of 800	3148	dllhost.exe	107
PID 3148 wrote to memory of 800	3148	dllhost.exe	107
PID 3148 wrote to memory of 2480	3148	dllhost.exe	108
PID 3148 wrote to memory of 2480	3148	dllhost.exe	108
PID 3148 wrote to memory of 2480	3148	dllhost.exe	108
PID 3148 wrote to memory of 5008	3148	dllhost.exe	110
PID 3148 wrote to memory of 5008	3148	dllhost.exe	110
PID 3148 wrote to memory of 5008	3148	dllhost.exe	110
PID 3148 wrote to memory of 4744	3148	dllhost.exe	111
PID 3148 wrote to memory of 4744	3148	dllhost.exe	111
PID 3148 wrote to memory of 4744	3148	dllhost.exe	111
PID 3148 wrote to memory of 4764	3148	dllhost.exe	127
PID 3148 wrote to memory of 4764	3148	dllhost.exe	127
PID 3148 wrote to memory of 4764	3148	dllhost.exe	127
PID 3148 wrote to memory of 2660	3148	dllhost.exe	114
PID 3148 wrote to memory of 2660	3148	dllhost.exe	114
PID 3148 wrote to memory of 2660	3148	dllhost.exe	114
PID 3148 wrote to memory of 4264	3148	dllhost.exe	117
PID 3148 wrote to memory of 4264	3148	dllhost.exe	117
PID 3148 wrote to memory of 4264	3148	dllhost.exe	117
PID 3148 wrote to memory of 4240	3148	dllhost.exe	118
PID 3148 wrote to memory of 4240	3148	dllhost.exe	118
PID 3148 wrote to memory of 4240	3148	dllhost.exe	118
PID 3148 wrote to memory of 4328	3148	dllhost.exe	119
PID 3148 wrote to memory of 4328	3148	dllhost.exe	119
PID 3148 wrote to memory of 4328	3148	dllhost.exe	119
PID 3148 wrote to memory of 3348	3148	dllhost.exe	125
PID 3148 wrote to memory of 3348	3148	dllhost.exe	125
PID 3148 wrote to memory of 3348	3148	dllhost.exe	125

C:\Users\Admin\AppData\Local\Temp\Fortnite Hack.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite Hack.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:166408
- - C:\Users\Admin\AppData\Local\Temp\MainModule.exe
    "C:\Users\Admin\AppData\Local\Temp\MainModule.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        5⤵
        
        PID:384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1896
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:636
  - - C:\ProgramData\Dllhost\dllhost.exe
      "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3148
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4728
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5232
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:800
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5224
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2480
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5292
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:5008
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5248
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4744
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5308
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:2660
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4264
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8648" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4240
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk8648" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5276
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7797" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4328
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8492" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:3224
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8492" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5316
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4981" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:3348
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk4981" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5264
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        5⤵
        
        PID:4764
      - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5300
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        5⤵
        
        PID:5468
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:5508
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
        5⤵
        
        PID:5924
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 1251
        6⤵
        
        PID:5976
      - C:\ProgramData\Dllhost\winlogson.exe
        
        C:\ProgramData\Dllhost\winlogson.exe -c config.json
        6⤵
        Executes dropped EXE
        
        PID:5996
- - C:\Users\Admin\AppData\Local\Temp\start.exe
    "C:\Users\Admin\AppData\Local\Temp\start.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1660
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\start.exe
      4⤵
      PID:5560
    - - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        5⤵
        
        PID:5616
- - C:\Users\Admin\AppData\Local\Temp\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\crypted.exe"
    3⤵
    - Executes dropped EXE
    PID:2976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
953KB

MD5
7dadec75c72d9ca68ad351b147ce82d7

SHA1
258718e852b80a293ea8505b2946190dcb3cd806

SHA256
12deb4d3b58a9102ba0a9493ce1e2ea38a57a50214e1da4261b1e2b3d7f5539a

SHA512
655e72a33457425b08592b7db8ab62ed232114355079de20fca23535e69e59bef13e971f48af83a382070abbb7620499b32bd8da5ad6b79f0e5f8502266ccf0d

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
953KB

MD5
7dadec75c72d9ca68ad351b147ce82d7

SHA1
258718e852b80a293ea8505b2946190dcb3cd806

SHA256
12deb4d3b58a9102ba0a9493ce1e2ea38a57a50214e1da4261b1e2b3d7f5539a

SHA512
655e72a33457425b08592b7db8ab62ed232114355079de20fca23535e69e59bef13e971f48af83a382070abbb7620499b32bd8da5ad6b79f0e5f8502266ccf0d

Download Submit
C:\ProgramData\Dllhost\winlogson.exe

Filesize
7.9MB

MD5
ae6c92c8073b1239390369d3ed93538f

SHA1
a76ea83bdcfa472cd593363e9bb254df494a5577

SHA256
d8d0e8ce7d532250713c7ac9c3e3d144463ce9f47bbf5bd6fc3bb939c739c1a0

SHA512
59de08ea3849243addb3b6aaa2b3ebf71a271eee77239bea0dd190d446a6eec56fd7c5b4fa3668c14074f33f06ab1f011baa0ac2266f6d2d33eb59847841c350

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin

Filesize
1KB

MD5
0135fad955fc63c0bda02c79738bde6d

SHA1
5d0e42e685510b0cdac4922444879761df721ed2

SHA256
2b6400b92aa887cf003ed65eb7b9906051872e4056ba7ab31cb77812435f6792

SHA512
cf4fd82a90095f9b8259380d8f80fbf5b116925068c898d016cda6a9c4a194a8733261a67e99f18d8f6262c62d36c2d1f98c9dccdf60140918e960d369e757fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
244036ab969f7cf8ee716f330f0d0ec5

SHA1
ba2999811638abbca79adfd805c3ae46765c928e

SHA256
1c4f28d26323a866e105e2a63c7da799b4790ff0b70ecc3be5e594fd4a9683fb

SHA512
deecfb56085b89bfb3eb8137031db827531f88553d8e90b3395a373aff0780341eaa7037479d4f2233a2d4e0281ee352ed2712a41b54a5402f641b34c711ca9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
1e9176ce607d42d608676ed6c0c24799

SHA1
2f23992d9e8100d71090b9092e668b52230fbf18

SHA256
dc9f353ad814968d7f074e89de404eaf9490c274d49e1433ab37b1c696217877

SHA512
158515e768c69ebe059ef251c0613bcc14d10db0c923b6112deeabaf5df26a55a544df555aed01259c0be0fd104f048dcddbfae095e6a3876c0b034afb71af93

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
C:\Users\Admin\AppData\Local\Temp\MainModule.exe

Filesize
71KB

MD5
f558323a0bd928b28d92886c451422af

SHA1
f8fea1577dde45a7e64beb369c7dd5a82f4e63b0

SHA256
1c1b228eb1b74e7e6145bda0fbbfc085bd8161246261b86c2accc74c3db5cdce

SHA512
29081513b01c9e477c1c5c27b7e31900a78ad6644f88d5d8923b386574628ad5180cbfb0d57f8cc6d339adfa425fc0f1231f4285a33d033ea18373cdd1273465

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\crypted.exe

Filesize
616KB

MD5
d95f63fa0b502ae717230d7392179e4b

SHA1
a8ea7f062f82967b349034d6e5879689dfe0785a

SHA256
3d7b54951fa0e3d98601ddde73932d4f0d0f82da51501266d6b7f78af3e12f04

SHA512
d8a82eb0468d9feec9d55bd9e0f71eec72f951144b0c4ca16b90d782029b94279d4647de8106f3740ec7cdc4a1bc92c66f73096c8a051aef2c2646914156defa

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
C:\Users\Admin\AppData\Local\Temp\start.exe

Filesize
4.0MB

MD5
06103d1e931ea83afb5cac974113c513

SHA1
ef70b042a19addb747697ee3270e1723ff988f5c

SHA256
5fdd4b20a3a14e37444235668e7f641e776e76104db82a17608d6ab283057b63

SHA512
f97ea97ef1431baef2372a7499a76a1edd9494ea31d6544b456d77d18120b4fb73dbc494a36f022b13613c4c636beb59cfb23f96a3386e3f39e9be0e14e1060f

Download Submit
memory/636-189-0x000000006DF20000-0x000000006DF6C000-memory.dmp

Filesize
304KB

Download
memory/1660-171-0x00000000004B0000-0x0000000001289000-memory.dmp

Filesize
13.8MB

Download
memory/1660-216-0x00000000004B0000-0x0000000001289000-memory.dmp

Filesize
13.8MB

Download
memory/1660-156-0x00000000004B0000-0x0000000001289000-memory.dmp

Filesize
13.8MB

Download
memory/1896-182-0x000000006DF20000-0x000000006DF6C000-memory.dmp

Filesize
304KB

Download
memory/2232-177-0x0000000007EB0000-0x0000000007ECA000-memory.dmp

Filesize
104KB

Download
memory/2232-172-0x00000000081E0000-0x000000000885A000-memory.dmp

Filesize
6.5MB

Download
memory/2232-178-0x0000000007DF0000-0x0000000007DF8000-memory.dmp

Filesize
32KB

Download
memory/2232-176-0x0000000007DB0000-0x0000000007DBE000-memory.dmp

Filesize
56KB

Download
memory/2232-175-0x0000000007E10000-0x0000000007EA6000-memory.dmp

Filesize
600KB

Download
memory/2232-163-0x00000000031F0000-0x0000000003226000-memory.dmp

Filesize
216KB

Download
memory/2232-164-0x0000000005A80000-0x00000000060A8000-memory.dmp

Filesize
6.2MB

Download
memory/2232-165-0x0000000005A50000-0x0000000005A72000-memory.dmp

Filesize
136KB

Download
memory/2232-166-0x00000000062A0000-0x0000000006306000-memory.dmp

Filesize
408KB

Download
memory/2232-167-0x0000000006840000-0x000000000685E000-memory.dmp

Filesize
120KB

Download
memory/2232-168-0x0000000007A10000-0x0000000007A42000-memory.dmp

Filesize
200KB

Download
memory/2232-169-0x000000006DF20000-0x000000006DF6C000-memory.dmp

Filesize
304KB

Download
memory/2232-170-0x0000000006E00000-0x0000000006E1E000-memory.dmp

Filesize
120KB

Download
memory/2232-174-0x0000000007BD0000-0x0000000007BDA000-memory.dmp

Filesize
40KB

Download
memory/2232-173-0x0000000007B80000-0x0000000007B9A000-memory.dmp

Filesize
104KB

Download
memory/2976-214-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download
memory/2976-218-0x0000000000510000-0x0000000000519000-memory.dmp

Filesize
36KB

Download
memory/3148-188-0x0000000000CE0000-0x0000000000DD4000-memory.dmp

Filesize
976KB

Download
memory/3756-152-0x000000000AC70000-0x000000000AC7A000-memory.dmp

Filesize
40KB

Download
memory/3756-151-0x0000000000F00000-0x0000000000F18000-memory.dmp

Filesize
96KB

Download
memory/166408-144-0x0000000007C20000-0x0000000007C3E000-memory.dmp

Filesize
120KB

Download
memory/166408-138-0x0000000007D10000-0x0000000007E1A000-memory.dmp

Filesize
1.0MB

Download
memory/166408-146-0x0000000009370000-0x000000000989C000-memory.dmp

Filesize
5.2MB

Download
memory/166408-137-0x0000000007BE0000-0x0000000007BF2000-memory.dmp

Filesize
72KB

Download
memory/166408-145-0x0000000008C70000-0x0000000008E32000-memory.dmp

Filesize
1.8MB

Download
memory/166408-139-0x0000000007C40000-0x0000000007C7C000-memory.dmp

Filesize
240KB

Download
memory/166408-147-0x0000000008400000-0x0000000008450000-memory.dmp

Filesize
320KB

Download
memory/166408-143-0x00000000057E0000-0x0000000005856000-memory.dmp

Filesize
472KB

Download
memory/166408-136-0x0000000005B60000-0x0000000006178000-memory.dmp

Filesize
6.1MB

Download
memory/166408-142-0x0000000005740000-0x00000000057D2000-memory.dmp

Filesize
584KB

Download
memory/166408-141-0x00000000084F0000-0x0000000008A94000-memory.dmp

Filesize
5.6MB

Download
memory/166408-140-0x0000000005630000-0x0000000005696000-memory.dmp

Filesize
408KB

Download
memory/166408-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download