redline | b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46

Analysis

max time kernel
162s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
Size

276KB
MD5

0d02c15eef61b85f35823b1c37ee6b0b
SHA1

a480af11f34cb38dc11cc363d025d66743c2ba91
SHA256

b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46
SHA512

bf02349edb7ba6522c472e1bda077b8a311b61a92829bd56f99bfdfb91d29ccb8a4aa91332bb0d95d31d01a0cc4c0124ddb6e69b8a880ec2e13e049641f0d3c2
SSDEEP

6144:QdD7MFE2x6O9Wy9kEZ/Ouo/t4hrwVfquS:Qd0FE2D9pks/OuoF4hd

Score

10^/10

redline smokeloader morn backdoor discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

Morn

80.66.87.20:80

Attributes

auth_value
98b8a59d3016c72d785854c61b951f1a

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral1/memory/4308-133-0x00000000005A0000-0x00000000005A9000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2784-240-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
4756	3642.exe
4996	57E5.exe
3592	5DA3.exe
1352	6228.exe
3772	75B1.exe
912	7BAD.exe
2320	7F58.exe
4172	wfyoot.exe
1992	SETUP_~1.EXE
804	wfyoot.exe
3720	Ublunueightcoordinate_s.exe
2784	SETUP_~1.EXE

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	75B1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	wfyoot.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Ublunueightcoordinate_s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	7F58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7F58.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 2784	1992	SETUP_~1.EXE	131

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
752	4756	WerFault.exe	88
3580	3772	WerFault.exe	98
1068	3772	WerFault.exe	98
1416	3772	WerFault.exe	98
2488	804	WerFault.exe	125
4624	804	WerFault.exe	125

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4308	b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
4308	b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2804	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
4308	b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found
2804	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	3642.exe
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeDebugPrivilege	1992	SETUP_~1.EXE
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found
Token: SeCreatePagefilePrivilege	2804	Process not Found
Token: SeShutdownPrivilege	2804	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 4756	2804	Process not Found	88
PID 2804 wrote to memory of 4756	2804	Process not Found	88
PID 2804 wrote to memory of 4756	2804	Process not Found	88
PID 2804 wrote to memory of 4996	2804	Process not Found	89
PID 2804 wrote to memory of 4996	2804	Process not Found	89
PID 2804 wrote to memory of 4996	2804	Process not Found	89
PID 2804 wrote to memory of 3592	2804	Process not Found	91
PID 2804 wrote to memory of 3592	2804	Process not Found	91
PID 2804 wrote to memory of 3592	2804	Process not Found	91
PID 2804 wrote to memory of 1352	2804	Process not Found	93
PID 2804 wrote to memory of 1352	2804	Process not Found	93
PID 2804 wrote to memory of 1352	2804	Process not Found	93
PID 2804 wrote to memory of 3772	2804	Process not Found	98
PID 2804 wrote to memory of 3772	2804	Process not Found	98
PID 2804 wrote to memory of 3772	2804	Process not Found	98
PID 2804 wrote to memory of 912	2804	Process not Found	99
PID 2804 wrote to memory of 912	2804	Process not Found	99
PID 2804 wrote to memory of 912	2804	Process not Found	99
PID 2804 wrote to memory of 2320	2804	Process not Found	101
PID 2804 wrote to memory of 2320	2804	Process not Found	101
PID 3772 wrote to memory of 4172	3772	75B1.exe	102
PID 3772 wrote to memory of 4172	3772	75B1.exe	102
PID 3772 wrote to memory of 4172	3772	75B1.exe	102
PID 2804 wrote to memory of 4344	2804	Process not Found	103
PID 2804 wrote to memory of 4344	2804	Process not Found	103
PID 2804 wrote to memory of 4344	2804	Process not Found	103
PID 2804 wrote to memory of 4344	2804	Process not Found	103
PID 2804 wrote to memory of 2076	2804	Process not Found	107
PID 2804 wrote to memory of 2076	2804	Process not Found	107
PID 2804 wrote to memory of 2076	2804	Process not Found	107
PID 2320 wrote to memory of 1992	2320	7F58.exe	111
PID 2320 wrote to memory of 1992	2320	7F58.exe	111
PID 2320 wrote to memory of 1992	2320	7F58.exe	111
PID 2804 wrote to memory of 1980	2804	Process not Found	112
PID 2804 wrote to memory of 1980	2804	Process not Found	112
PID 2804 wrote to memory of 1980	2804	Process not Found	112
PID 2804 wrote to memory of 1980	2804	Process not Found	112
PID 2804 wrote to memory of 3548	2804	Process not Found	114
PID 2804 wrote to memory of 3548	2804	Process not Found	114
PID 2804 wrote to memory of 3548	2804	Process not Found	114
PID 2804 wrote to memory of 1960	2804	Process not Found	116
PID 2804 wrote to memory of 1960	2804	Process not Found	116
PID 2804 wrote to memory of 1960	2804	Process not Found	116
PID 2804 wrote to memory of 1960	2804	Process not Found	116
PID 4172 wrote to memory of 1308	4172	wfyoot.exe	117
PID 4172 wrote to memory of 1308	4172	wfyoot.exe	117
PID 4172 wrote to memory of 1308	4172	wfyoot.exe	117
PID 2804 wrote to memory of 1620	2804	Process not Found	119
PID 2804 wrote to memory of 1620	2804	Process not Found	119
PID 2804 wrote to memory of 1620	2804	Process not Found	119
PID 2804 wrote to memory of 1620	2804	Process not Found	119
PID 2804 wrote to memory of 212	2804	Process not Found	120
PID 2804 wrote to memory of 212	2804	Process not Found	120
PID 2804 wrote to memory of 212	2804	Process not Found	120
PID 2804 wrote to memory of 212	2804	Process not Found	120
PID 2804 wrote to memory of 1300	2804	Process not Found	121
PID 2804 wrote to memory of 1300	2804	Process not Found	121
PID 2804 wrote to memory of 1300	2804	Process not Found	121
PID 2804 wrote to memory of 1736	2804	Process not Found	122
PID 2804 wrote to memory of 1736	2804	Process not Found	122
PID 2804 wrote to memory of 1736	2804	Process not Found	122
PID 2804 wrote to memory of 1736	2804	Process not Found	122
PID 1992 wrote to memory of 2388	1992	SETUP_~1.EXE	123
PID 1992 wrote to memory of 2388	1992	SETUP_~1.EXE	123

C:\Users\Admin\AppData\Local\Temp\b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe
"C:\Users\Admin\AppData\Local\Temp\b625361a15c00ad25adfa2130dfa1033108cebad9705db647b64f4e43e3d8b46.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4308

C:\Users\Admin\AppData\Local\Temp\3642.exe
C:\Users\Admin\AppData\Local\Temp\3642.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 1660
  2⤵
  - Program crash
  PID:752

C:\Users\Admin\AppData\Local\Temp\57E5.exe
C:\Users\Admin\AppData\Local\Temp\57E5.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Users\Admin\AppData\Local\Temp\5DA3.exe
C:\Users\Admin\AppData\Local\Temp\5DA3.exe
1⤵
- Executes dropped EXE
PID:3592

C:\Users\Admin\AppData\Local\Temp\6228.exe
C:\Users\Admin\AppData\Local\Temp\6228.exe
1⤵
- Executes dropped EXE
PID:1352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4756 -ip 4756
1⤵
PID:4404

C:\Users\Admin\AppData\Local\Temp\75B1.exe
C:\Users\Admin\AppData\Local\Temp\75B1.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN wfyoot.exe /TR "C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 904
  2⤵
  - Program crash
  PID:3580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 876
  2⤵
  - Program crash
  PID:1068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 1252
  2⤵
  - Program crash
  PID:1416

C:\Users\Admin\AppData\Local\Temp\7BAD.exe
C:\Users\Admin\AppData\Local\Temp\7BAD.exe
1⤵
- Executes dropped EXE
PID:912

C:\Users\Admin\AppData\Local\Temp\7F58.exe
C:\Users\Admin\AppData\Local\Temp\7F58.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe
    "C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:3720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
      4⤵
      PID:912
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    PID:2784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3772 -ip 3772
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3772 -ip 3772
1⤵
PID:4316

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3772 -ip 3772
1⤵
PID:5032

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1980

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1960

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1620

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:212

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1300

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
1⤵
- Executes dropped EXE
PID:804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 316
  2⤵
  - Program crash
  PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 324
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 804 -ip 804
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 804 -ip 804
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log

Filesize
1KB

MD5
3da8c0e0973f3328da5363ce1d655b26

SHA1
12e5547ce28ac5e8b8cfea10cb228fdb207f3d6f

SHA256
1986c5a00286a7bbb272103161f960b11d47e6b67900eaa14e0160bc7d27ca94

SHA512
7a351d62d80a19a1682b54a8850afbb58819f03a7beae9b1feac7246a2d7f275e253ed40e4a9f3ecfecbca4420dae2571cf88872c8543221d490b51949e949c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
6195a91754effb4df74dbc72cdf4f7a6

SHA1
aba262f5726c6d77659fe0d3195e36a85046b427

SHA256
3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5

SHA512
ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
3041399062200f89e9eafae41e5a12d1

SHA1
50872c2a1edf33d320582f12561d02f2629b6745

SHA256
a98d05dde5413c12be9f5813e78367294ced555157d10c47e141c7ef6bae255f

SHA512
4193a1f663c0d327152c6731df5390b30972ede07baf21275c4485c90e26b9b8b942243fe891dfef66f5cbbb5efb430f3ac6dd0841c8bdc5e607261ad913893f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe

Filesize
325KB

MD5
79a930cc9ed859882bd7f37253445348

SHA1
9bd608f5e367c2f8fe370eb79ad3cd756ef4cb91

SHA256
5783eba9c88cdb66442caf872e636de062e218240386661948f918ecc2ae3c51

SHA512
31f843ec49509f3580595d5e3e4bd20cd3322e6ca04f7d1c8ed4770996a163e86629f9478f8cb9587b72ce4fadad55f710cec30db9cdafe64b035db5d43cdfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe

Filesize
325KB

MD5
79a930cc9ed859882bd7f37253445348

SHA1
9bd608f5e367c2f8fe370eb79ad3cd756ef4cb91

SHA256
5783eba9c88cdb66442caf872e636de062e218240386661948f918ecc2ae3c51

SHA512
31f843ec49509f3580595d5e3e4bd20cd3322e6ca04f7d1c8ed4770996a163e86629f9478f8cb9587b72ce4fadad55f710cec30db9cdafe64b035db5d43cdfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe

Filesize
325KB

MD5
79a930cc9ed859882bd7f37253445348

SHA1
9bd608f5e367c2f8fe370eb79ad3cd756ef4cb91

SHA256
5783eba9c88cdb66442caf872e636de062e218240386661948f918ecc2ae3c51

SHA512
31f843ec49509f3580595d5e3e4bd20cd3322e6ca04f7d1c8ed4770996a163e86629f9478f8cb9587b72ce4fadad55f710cec30db9cdafe64b035db5d43cdfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\3642.exe

Filesize
421KB

MD5
331e9467ace2c12e1142a7af3861be0a

SHA1
d148319627a24bef5de80ee1dc8d805b7322db64

SHA256
2c8158054be8f59049ffba2ef8555dbe76812ddef3628dc9e06491ee982f1c61

SHA512
19c8c715d50771737803da03ed97a487012aa1586e68f51db3c437adbc8c69721400ab32b1ecedce05d53ffd7467d9f7cae054e3b763dde7f475155a6678b589

Download Submit
C:\Users\Admin\AppData\Local\Temp\3642.exe

Filesize
421KB

MD5
331e9467ace2c12e1142a7af3861be0a

SHA1
d148319627a24bef5de80ee1dc8d805b7322db64

SHA256
2c8158054be8f59049ffba2ef8555dbe76812ddef3628dc9e06491ee982f1c61

SHA512
19c8c715d50771737803da03ed97a487012aa1586e68f51db3c437adbc8c69721400ab32b1ecedce05d53ffd7467d9f7cae054e3b763dde7f475155a6678b589

Download Submit
C:\Users\Admin\AppData\Local\Temp\57E5.exe

Filesize
720KB

MD5
34c9b2563434dc04cfc5ec0d165076ea

SHA1
983a62d491972c8e50af42e133a7f126cd18ffb9

SHA256
beb1bdbc9b36231fe4e5319229e8316c75520551b717d5dde566f99be9e3a97e

SHA512
aecee67131b9de6e9749e59dfcbd9468ce412bad899064eab56745b335f40cd0e40c0f1ec9b69b2237fe1f0312c6a7e873852fb0f9750f0b0e7e65cc1ad55a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\57E5.exe

Filesize
720KB

MD5
34c9b2563434dc04cfc5ec0d165076ea

SHA1
983a62d491972c8e50af42e133a7f126cd18ffb9

SHA256
beb1bdbc9b36231fe4e5319229e8316c75520551b717d5dde566f99be9e3a97e

SHA512
aecee67131b9de6e9749e59dfcbd9468ce412bad899064eab56745b335f40cd0e40c0f1ec9b69b2237fe1f0312c6a7e873852fb0f9750f0b0e7e65cc1ad55a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\5DA3.exe

Filesize
783KB

MD5
7f3294b1b10b086cee0c2f9f4cad4a44

SHA1
3919b25280d25dc5deea3d34ddf9514626b7b018

SHA256
e999aec023590c59392f9f7696f3d289aaac23b4d349e081f300d3c46f45bc13

SHA512
2266699746bd25d274bb73bec2ced408bbfacd763d4f44edad4b8023ec2903bb94442d7035d0acb2b951cac8f46812034ed1cb136a8ea781f771def1c4cd6fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5DA3.exe

Filesize
783KB

MD5
7f3294b1b10b086cee0c2f9f4cad4a44

SHA1
3919b25280d25dc5deea3d34ddf9514626b7b018

SHA256
e999aec023590c59392f9f7696f3d289aaac23b4d349e081f300d3c46f45bc13

SHA512
2266699746bd25d274bb73bec2ced408bbfacd763d4f44edad4b8023ec2903bb94442d7035d0acb2b951cac8f46812034ed1cb136a8ea781f771def1c4cd6fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\6228.exe

Filesize
720KB

MD5
866b5b2163c1478071179682952d2b24

SHA1
53d06993c0913d9d8af0740f94417c5cfac52cfa

SHA256
4db9e17d126856919f1366761d80bbb6b852b4f14aa9b4698c50de83ddbe74df

SHA512
53ea9b38146e6cdf7d39395ecf84a2e0e108052da270811104d6217960965247ee1ceb8a559ff4b2de716ab367fc445d39b4a7f832e5daf06aac9a89b6ee4304

Download Submit
C:\Users\Admin\AppData\Local\Temp\6228.exe

Filesize
720KB

MD5
866b5b2163c1478071179682952d2b24

SHA1
53d06993c0913d9d8af0740f94417c5cfac52cfa

SHA256
4db9e17d126856919f1366761d80bbb6b852b4f14aa9b4698c50de83ddbe74df

SHA512
53ea9b38146e6cdf7d39395ecf84a2e0e108052da270811104d6217960965247ee1ceb8a559ff4b2de716ab367fc445d39b4a7f832e5daf06aac9a89b6ee4304

Download Submit
C:\Users\Admin\AppData\Local\Temp\75B1.exe

Filesize
325KB

MD5
79a930cc9ed859882bd7f37253445348

SHA1
9bd608f5e367c2f8fe370eb79ad3cd756ef4cb91

SHA256
5783eba9c88cdb66442caf872e636de062e218240386661948f918ecc2ae3c51

SHA512
31f843ec49509f3580595d5e3e4bd20cd3322e6ca04f7d1c8ed4770996a163e86629f9478f8cb9587b72ce4fadad55f710cec30db9cdafe64b035db5d43cdfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\75B1.exe

Filesize
325KB

MD5
79a930cc9ed859882bd7f37253445348

SHA1
9bd608f5e367c2f8fe370eb79ad3cd756ef4cb91

SHA256
5783eba9c88cdb66442caf872e636de062e218240386661948f918ecc2ae3c51

SHA512
31f843ec49509f3580595d5e3e4bd20cd3322e6ca04f7d1c8ed4770996a163e86629f9478f8cb9587b72ce4fadad55f710cec30db9cdafe64b035db5d43cdfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\7BAD.exe

Filesize
720KB

MD5
76f49e4c7c466ca27af9420399608af5

SHA1
0d61a9e9cecae0b259fec2aac1a89938fe5265d9

SHA256
579392006c5a06592ed6d56e0593e8c272b704c0849ecf6d8f1502ea02c75435

SHA512
1dee0a768259f168d5d71f296c2ecbf1068c59d56be24a5b48f40d26c5cb5114cce2ccd76a3147b5d89ebdfde3331696be58f828eb4ba6ee581efce95aff1a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7BAD.exe

Filesize
720KB

MD5
76f49e4c7c466ca27af9420399608af5

SHA1
0d61a9e9cecae0b259fec2aac1a89938fe5265d9

SHA256
579392006c5a06592ed6d56e0593e8c272b704c0849ecf6d8f1502ea02c75435

SHA512
1dee0a768259f168d5d71f296c2ecbf1068c59d56be24a5b48f40d26c5cb5114cce2ccd76a3147b5d89ebdfde3331696be58f828eb4ba6ee581efce95aff1a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7F58.exe

Filesize
324KB

MD5
aa2f8b0d3789435b5e54091da183751d

SHA1
95c16dfb6fd4edc2b953618a425802eb490ab120

SHA256
9579f141b148827a8307419bfe076a7e9ab2f21665b8dd8467ca480be1365d49

SHA512
134e54710efdf0711e95666c0b0b8b5bf7ef83ddc4bd51f456a859bf48b593baec35858abad3bace24b136219dbb7a45132193386c42c7e98ba928e5e37688f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
3990e96786a7e747582a5602a0a737c0

SHA1
97216187976c789e8e5607c97dfa237cd3830fa3

SHA256
de2cd2cf517def1db1d199d4ce15749f6ee78842661486c29a84c678f3cc3361

SHA512
d36e580b26d98e553a56b790d82f6ed58ffeb9b4855525787f1d6806e7fea3836e59ea794b446cb215debf0697607daa673d61aafec4c0c17d66259af88063a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
3990e96786a7e747582a5602a0a737c0

SHA1
97216187976c789e8e5607c97dfa237cd3830fa3

SHA256
de2cd2cf517def1db1d199d4ce15749f6ee78842661486c29a84c678f3cc3361

SHA512
d36e580b26d98e553a56b790d82f6ed58ffeb9b4855525787f1d6806e7fea3836e59ea794b446cb215debf0697607daa673d61aafec4c0c17d66259af88063a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
3990e96786a7e747582a5602a0a737c0

SHA1
97216187976c789e8e5607c97dfa237cd3830fa3

SHA256
de2cd2cf517def1db1d199d4ce15749f6ee78842661486c29a84c678f3cc3361

SHA512
d36e580b26d98e553a56b790d82f6ed58ffeb9b4855525787f1d6806e7fea3836e59ea794b446cb215debf0697607daa673d61aafec4c0c17d66259af88063a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe

Filesize
20KB

MD5
fdd1636981a691eda3fda7458f7d10d0

SHA1
3b20a5d550ccf66718a83674745e7353b27b0870

SHA256
ef1d21c1510eaa3465e4dccc76183b756f163658d8a830181c7f7e9b9d4c5e4f

SHA512
18dc2b0db9fc2ef91ac4d4ef3920f527ac0b2630cd4bcbe04855dfe635f2237b4f817da8a0a131f41caa2c1f22a2e633e05757b7b1d8a46b889aabbf65fe5901

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe

Filesize
20KB

MD5
fdd1636981a691eda3fda7458f7d10d0

SHA1
3b20a5d550ccf66718a83674745e7353b27b0870

SHA256
ef1d21c1510eaa3465e4dccc76183b756f163658d8a830181c7f7e9b9d4c5e4f

SHA512
18dc2b0db9fc2ef91ac4d4ef3920f527ac0b2630cd4bcbe04855dfe635f2237b4f817da8a0a131f41caa2c1f22a2e633e05757b7b1d8a46b889aabbf65fe5901

Download Submit
memory/212-208-0x0000000000C50000-0x0000000000C56000-memory.dmp

Filesize
24KB

Download
memory/212-229-0x0000000000C50000-0x0000000000C56000-memory.dmp

Filesize
24KB

Download
memory/212-206-0x0000000000C40000-0x0000000000C4B000-memory.dmp

Filesize
44KB

Download
memory/804-233-0x00000000005FA000-0x0000000000617000-memory.dmp

Filesize
116KB

Download
memory/1300-212-0x0000000000600000-0x000000000060D000-memory.dmp

Filesize
52KB

Download
memory/1300-230-0x0000000000610000-0x0000000000617000-memory.dmp

Filesize
28KB

Download
memory/1300-211-0x0000000000610000-0x0000000000617000-memory.dmp

Filesize
28KB

Download
memory/1620-204-0x0000000000580000-0x0000000000585000-memory.dmp

Filesize
20KB

Download
memory/1620-228-0x0000000000580000-0x0000000000585000-memory.dmp

Filesize
20KB

Download
memory/1620-205-0x0000000000570000-0x0000000000579000-memory.dmp

Filesize
36KB

Download
memory/1736-217-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/1736-231-0x0000000000540000-0x0000000000548000-memory.dmp

Filesize
32KB

Download
memory/1736-213-0x0000000000530000-0x000000000053B000-memory.dmp

Filesize
44KB

Download
memory/1960-227-0x0000000000F70000-0x0000000000F92000-memory.dmp

Filesize
136KB

Download
memory/1960-201-0x0000000000F70000-0x0000000000F92000-memory.dmp

Filesize
136KB

Download
memory/1960-199-0x0000000000F40000-0x0000000000F67000-memory.dmp

Filesize
156KB

Download
memory/1980-224-0x0000000000190000-0x0000000000195000-memory.dmp

Filesize
20KB

Download
memory/1980-191-0x0000000000190000-0x0000000000195000-memory.dmp

Filesize
20KB

Download
memory/1980-192-0x0000000000180000-0x0000000000189000-memory.dmp

Filesize
36KB

Download
memory/1992-188-0x0000000000880000-0x000000000088A000-memory.dmp

Filesize
40KB

Download
memory/1992-209-0x0000000008350000-0x0000000008372000-memory.dmp

Filesize
136KB

Download
memory/1992-190-0x00000000051A0000-0x00000000051AA000-memory.dmp

Filesize
40KB

Download
memory/2076-183-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download
memory/2076-184-0x00000000004B0000-0x00000000004BF000-memory.dmp

Filesize
60KB

Download
memory/2076-221-0x00000000004C0000-0x00000000004C9000-memory.dmp

Filesize
36KB

Download
memory/2388-223-0x0000000006000000-0x000000000601A000-memory.dmp

Filesize
104KB

Download
memory/2388-218-0x0000000004DE0000-0x0000000004E46000-memory.dmp

Filesize
408KB

Download
memory/2388-216-0x0000000004E70000-0x0000000005498000-memory.dmp

Filesize
6.2MB

Download
memory/2388-215-0x0000000000DC0000-0x0000000000DF6000-memory.dmp

Filesize
216KB

Download
memory/2388-219-0x0000000005B20000-0x0000000005B3E000-memory.dmp

Filesize
120KB

Download
memory/2388-222-0x00000000073A0000-0x0000000007A1A000-memory.dmp

Filesize
6.5MB

Download
memory/2784-240-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3548-196-0x00000000009C0000-0x00000000009CC000-memory.dmp

Filesize
48KB

Download
memory/3548-225-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/3548-194-0x00000000009D0000-0x00000000009D6000-memory.dmp

Filesize
24KB

Download
memory/3772-177-0x00000000006D7000-0x00000000006F3000-memory.dmp

Filesize
112KB

Download
memory/3772-178-0x00000000008C0000-0x00000000008F7000-memory.dmp

Filesize
220KB

Download
memory/3772-179-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4172-226-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4172-198-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4172-197-0x00000000006F6000-0x0000000000712000-memory.dmp

Filesize
112KB

Download
memory/4308-135-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4308-134-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4308-132-0x0000000000617000-0x0000000000627000-memory.dmp

Filesize
64KB

Download
memory/4308-133-0x00000000005A0000-0x00000000005A9000-memory.dmp

Filesize
36KB

Download
memory/4344-180-0x00000000001C0000-0x00000000001CB000-memory.dmp

Filesize
44KB

Download
memory/4344-220-0x00000000001D0000-0x00000000001D7000-memory.dmp

Filesize
28KB

Download
memory/4344-182-0x00000000001D0000-0x00000000001D7000-memory.dmp

Filesize
28KB

Download
memory/4756-152-0x0000000006800000-0x0000000006D2C000-memory.dmp

Filesize
5.2MB

Download
memory/4756-142-0x0000000004DB0000-0x0000000005354000-memory.dmp

Filesize
5.6MB

Download
memory/4756-148-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/4756-147-0x0000000005C90000-0x0000000005D22000-memory.dmp

Filesize
584KB

Download
memory/4756-146-0x0000000005980000-0x00000000059BC000-memory.dmp

Filesize
240KB

Download
memory/4756-145-0x0000000004C90000-0x0000000004D9A000-memory.dmp

Filesize
1.0MB

Download
memory/4756-144-0x0000000004C70000-0x0000000004C82000-memory.dmp

Filesize
72KB

Download
memory/4756-143-0x0000000005360000-0x0000000005978000-memory.dmp

Filesize
6.1MB

Download
memory/4756-150-0x0000000006570000-0x00000000065E6000-memory.dmp

Filesize
472KB

Download
memory/4756-149-0x0000000006400000-0x0000000006450000-memory.dmp

Filesize
320KB

Download
memory/4756-141-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4756-151-0x0000000006630000-0x00000000067F2000-memory.dmp

Filesize
1.8MB

Download
memory/4756-153-0x0000000006E70000-0x0000000006E8E000-memory.dmp

Filesize
120KB

Download
memory/4756-140-0x0000000002100000-0x0000000002159000-memory.dmp

Filesize
356KB

Download
memory/4756-139-0x000000000067D000-0x00000000006B4000-memory.dmp

Filesize
220KB

Download
memory/4756-164-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4756-163-0x000000000067D000-0x00000000006B4000-memory.dmp

Filesize
220KB

Download