redline | 187d17124e094fe0e9f2115d7c538c8a98d33242cd0f14c475ead520d08c1eb0

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17788c4bfa647b05751138f7e96edf03.exe
Size

267KB
MD5

17788c4bfa647b05751138f7e96edf03
SHA1

b898478a64450cc28b85f27b0a3365c9cd4d8af1
SHA256

187d17124e094fe0e9f2115d7c538c8a98d33242cd0f14c475ead520d08c1eb0
SHA512

45ef3053e0da9e81596f75b6e228ad7e06290737d90a17c0dc38440b1bd04666a2a9adb68e5ee918b74252437dc001be048c478861de1c6d1de06106f19f5b8d
SSDEEP

3072:rXYChY9AUUQKpXHKm5bEq/AVPFUTVsPErvYYWrxpzbgqruEqypZa9uD6VdyhksRP:Dl9pX/Eq/AVPsPDYYuzbgwudywVfs

Score

10^/10

redline smokeloader morn backdoor discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

Morn

80.66.87.20:80

Attributes

auth_value
98b8a59d3016c72d785854c61b951f1a

Signatures

Detects Smokeloader packer 2 IoCs

resource	yara_rule
behavioral2/memory/3976-133-0x00000000004D0000-0x00000000004D9000-memory.dmp	family_smokeloader
behavioral2/memory/4080-249-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/1816-238-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1648	DBCE.exe
4028	FCD4.exe
3756	292.exe
3536	717.exe
3516	1689.exe
4080	1D60.exe
5084	2040.exe
1336	wfyoot.exe
2396	SETUP_~1.EXE
2952	Ublunueightcoordinate_s.exe
1816	SETUP_~1.EXE
3172	wfyoot.exe
4080	Ublunueightcoordinate_s.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1689.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	SETUP_~1.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wfyoot.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Ublunueightcoordinate_s.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	2040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2040.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 1816	2396	SETUP_~1.EXE	122
PID 2952 set thread context of 4080	2952	Ublunueightcoordinate_s.exe	128

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4308	1648	WerFault.exe	88
1608	3516	WerFault.exe	98
1948	3172	WerFault.exe	125

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17788c4bfa647b05751138f7e96edf03.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17788c4bfa647b05751138f7e96edf03.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17788c4bfa647b05751138f7e96edf03.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ublunueightcoordinate_s.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ublunueightcoordinate_s.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Ublunueightcoordinate_s.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3976	17788c4bfa647b05751138f7e96edf03.exe
3976	17788c4bfa647b05751138f7e96edf03.exe
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	Process not Found

Suspicious behavior: MapViewOfSection 20 IoCs

pid	Process
3976	17788c4bfa647b05751138f7e96edf03.exe
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
2824	Process not Found
4080	Ublunueightcoordinate_s.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	DBCE.exe
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeDebugPrivilege	2396	SETUP_~1.EXE
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeShutdownPrivilege	2824	Process not Found
Token: SeCreatePagefilePrivilege	2824	Process not Found
Token: SeDebugPrivilege	2952	Ublunueightcoordinate_s.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 1648	2824	Process not Found	88
PID 2824 wrote to memory of 1648	2824	Process not Found	88
PID 2824 wrote to memory of 1648	2824	Process not Found	88
PID 2824 wrote to memory of 4028	2824	Process not Found	89
PID 2824 wrote to memory of 4028	2824	Process not Found	89
PID 2824 wrote to memory of 4028	2824	Process not Found	89
PID 2824 wrote to memory of 3756	2824	Process not Found	91
PID 2824 wrote to memory of 3756	2824	Process not Found	91
PID 2824 wrote to memory of 3756	2824	Process not Found	91
PID 2824 wrote to memory of 3536	2824	Process not Found	93
PID 2824 wrote to memory of 3536	2824	Process not Found	93
PID 2824 wrote to memory of 3536	2824	Process not Found	93
PID 2824 wrote to memory of 3516	2824	Process not Found	98
PID 2824 wrote to memory of 3516	2824	Process not Found	98
PID 2824 wrote to memory of 3516	2824	Process not Found	98
PID 2824 wrote to memory of 4080	2824	Process not Found	99
PID 2824 wrote to memory of 4080	2824	Process not Found	99
PID 2824 wrote to memory of 4080	2824	Process not Found	99
PID 2824 wrote to memory of 5084	2824	Process not Found	101
PID 2824 wrote to memory of 5084	2824	Process not Found	101
PID 2824 wrote to memory of 3104	2824	Process not Found	102
PID 2824 wrote to memory of 3104	2824	Process not Found	102
PID 2824 wrote to memory of 3104	2824	Process not Found	102
PID 2824 wrote to memory of 3104	2824	Process not Found	102
PID 2824 wrote to memory of 4908	2824	Process not Found	103
PID 2824 wrote to memory of 4908	2824	Process not Found	103
PID 2824 wrote to memory of 4908	2824	Process not Found	103
PID 3516 wrote to memory of 1336	3516	1689.exe	104
PID 3516 wrote to memory of 1336	3516	1689.exe	104
PID 3516 wrote to memory of 1336	3516	1689.exe	104
PID 5084 wrote to memory of 2396	5084	2040.exe	107
PID 5084 wrote to memory of 2396	5084	2040.exe	107
PID 5084 wrote to memory of 2396	5084	2040.exe	107
PID 2824 wrote to memory of 4128	2824	Process not Found	108
PID 2824 wrote to memory of 4128	2824	Process not Found	108
PID 2824 wrote to memory of 4128	2824	Process not Found	108
PID 2824 wrote to memory of 4128	2824	Process not Found	108
PID 2824 wrote to memory of 2544	2824	Process not Found	111
PID 2824 wrote to memory of 2544	2824	Process not Found	111
PID 2824 wrote to memory of 2544	2824	Process not Found	111
PID 2824 wrote to memory of 2540	2824	Process not Found	112
PID 2824 wrote to memory of 2540	2824	Process not Found	112
PID 2824 wrote to memory of 2540	2824	Process not Found	112
PID 2824 wrote to memory of 2540	2824	Process not Found	112
PID 2824 wrote to memory of 1852	2824	Process not Found	113
PID 2824 wrote to memory of 1852	2824	Process not Found	113
PID 2824 wrote to memory of 1852	2824	Process not Found	113
PID 2824 wrote to memory of 1852	2824	Process not Found	113
PID 2824 wrote to memory of 1864	2824	Process not Found	114
PID 2824 wrote to memory of 1864	2824	Process not Found	114
PID 2824 wrote to memory of 1864	2824	Process not Found	114
PID 2824 wrote to memory of 1864	2824	Process not Found	114
PID 2396 wrote to memory of 1276	2396	SETUP_~1.EXE	115
PID 2396 wrote to memory of 1276	2396	SETUP_~1.EXE	115
PID 2396 wrote to memory of 1276	2396	SETUP_~1.EXE	115
PID 1336 wrote to memory of 4448	1336	wfyoot.exe	117
PID 1336 wrote to memory of 4448	1336	wfyoot.exe	117
PID 1336 wrote to memory of 4448	1336	wfyoot.exe	117
PID 2824 wrote to memory of 3976	2824	Process not Found	119
PID 2824 wrote to memory of 3976	2824	Process not Found	119
PID 2824 wrote to memory of 3976	2824	Process not Found	119
PID 2824 wrote to memory of 4976	2824	Process not Found	120
PID 2824 wrote to memory of 4976	2824	Process not Found	120
PID 2824 wrote to memory of 4976	2824	Process not Found	120

C:\Users\Admin\AppData\Local\Temp\17788c4bfa647b05751138f7e96edf03.exe
"C:\Users\Admin\AppData\Local\Temp\17788c4bfa647b05751138f7e96edf03.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3976

C:\Users\Admin\AppData\Local\Temp\DBCE.exe
C:\Users\Admin\AppData\Local\Temp\DBCE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 2000
  2⤵
  - Program crash
  PID:4308

C:\Users\Admin\AppData\Local\Temp\FCD4.exe
C:\Users\Admin\AppData\Local\Temp\FCD4.exe
1⤵
- Executes dropped EXE
PID:4028

C:\Users\Admin\AppData\Local\Temp\292.exe
C:\Users\Admin\AppData\Local\Temp\292.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Users\Admin\AppData\Local\Temp\717.exe
C:\Users\Admin\AppData\Local\Temp\717.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1648 -ip 1648
1⤵
PID:4232

C:\Users\Admin\AppData\Local\Temp\1689.exe
C:\Users\Admin\AppData\Local\Temp\1689.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
  "C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN wfyoot.exe /TR "C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 904
  2⤵
  - Program crash
  PID:1608

C:\Users\Admin\AppData\Local\Temp\1D60.exe
C:\Users\Admin\AppData\Local\Temp\1D60.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\AppData\Local\Temp\2040.exe
C:\Users\Admin\AppData\Local\Temp\2040.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe
    "C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA0AA==
      4⤵
      PID:3428
  - - C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe
      C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: MapViewOfSection
      PID:4080
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    3⤵
    - Executes dropped EXE
    PID:1816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3104

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3516 -ip 3516
1⤵
PID:3268

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4128

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2544

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2540

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1852

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1864

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3976

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe
1⤵
- Executes dropped EXE
PID:3172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 324
  2⤵
  - Program crash
  PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3172 -ip 3172
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log

Filesize
1KB

MD5
3da8c0e0973f3328da5363ce1d655b26

SHA1
12e5547ce28ac5e8b8cfea10cb228fdb207f3d6f

SHA256
1986c5a00286a7bbb272103161f960b11d47e6b67900eaa14e0160bc7d27ca94

SHA512
7a351d62d80a19a1682b54a8850afbb58819f03a7beae9b1feac7246a2d7f275e253ed40e4a9f3ecfecbca4420dae2571cf88872c8543221d490b51949e949c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
6195a91754effb4df74dbc72cdf4f7a6

SHA1
aba262f5726c6d77659fe0d3195e36a85046b427

SHA256
3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5

SHA512
ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
6fb22ae3e1ae96b5e8d7a800568f1588

SHA1
72e85acd9eaf9d9e3384a65810e88bd80e2c3570

SHA256
5aae1f7cdf57cf67a657572dd255a38d99a427f8467a196b8a527049c4f6da94

SHA512
009c7a980dc45865a65b4a94597613edb5fa90393df7a32730b6390a5c302f8f8424423e151b838887526a3979119bde020b86bf1e4bcf06223e388f3893e5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe

Filesize
324KB

MD5
03321edebed139c7b73189e75a919864

SHA1
ce89b8b869d37ec45629c3dfbc8862fa401a448f

SHA256
c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5

SHA512
7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe

Filesize
324KB

MD5
03321edebed139c7b73189e75a919864

SHA1
ce89b8b869d37ec45629c3dfbc8862fa401a448f

SHA256
c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5

SHA512
7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\0fd408e638\wfyoot.exe

Filesize
324KB

MD5
03321edebed139c7b73189e75a919864

SHA1
ce89b8b869d37ec45629c3dfbc8862fa401a448f

SHA256
c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5

SHA512
7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\1689.exe

Filesize
324KB

MD5
03321edebed139c7b73189e75a919864

SHA1
ce89b8b869d37ec45629c3dfbc8862fa401a448f

SHA256
c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5

SHA512
7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\1689.exe

Filesize
324KB

MD5
03321edebed139c7b73189e75a919864

SHA1
ce89b8b869d37ec45629c3dfbc8862fa401a448f

SHA256
c44e83861ea09273f134bfcb92bd1c48053763f761576cac3a9985e7f88a51b5

SHA512
7f3471dbc2bf7fa75a06dc092cfb65fdadc13223b66d1b235f24a574ec98cfdfc7dfe425268ff63dfce67f47b94653d0c145a008f3a46d522ccd2ac28a258e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\1D60.exe

Filesize
720KB

MD5
76f49e4c7c466ca27af9420399608af5

SHA1
0d61a9e9cecae0b259fec2aac1a89938fe5265d9

SHA256
579392006c5a06592ed6d56e0593e8c272b704c0849ecf6d8f1502ea02c75435

SHA512
1dee0a768259f168d5d71f296c2ecbf1068c59d56be24a5b48f40d26c5cb5114cce2ccd76a3147b5d89ebdfde3331696be58f828eb4ba6ee581efce95aff1a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1D60.exe

Filesize
720KB

MD5
76f49e4c7c466ca27af9420399608af5

SHA1
0d61a9e9cecae0b259fec2aac1a89938fe5265d9

SHA256
579392006c5a06592ed6d56e0593e8c272b704c0849ecf6d8f1502ea02c75435

SHA512
1dee0a768259f168d5d71f296c2ecbf1068c59d56be24a5b48f40d26c5cb5114cce2ccd76a3147b5d89ebdfde3331696be58f828eb4ba6ee581efce95aff1a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\2040.exe

Filesize
324KB

MD5
aa2f8b0d3789435b5e54091da183751d

SHA1
95c16dfb6fd4edc2b953618a425802eb490ab120

SHA256
9579f141b148827a8307419bfe076a7e9ab2f21665b8dd8467ca480be1365d49

SHA512
134e54710efdf0711e95666c0b0b8b5bf7ef83ddc4bd51f456a859bf48b593baec35858abad3bace24b136219dbb7a45132193386c42c7e98ba928e5e37688f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\292.exe

Filesize
783KB

MD5
7f3294b1b10b086cee0c2f9f4cad4a44

SHA1
3919b25280d25dc5deea3d34ddf9514626b7b018

SHA256
e999aec023590c59392f9f7696f3d289aaac23b4d349e081f300d3c46f45bc13

SHA512
2266699746bd25d274bb73bec2ced408bbfacd763d4f44edad4b8023ec2903bb94442d7035d0acb2b951cac8f46812034ed1cb136a8ea781f771def1c4cd6fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\292.exe

Filesize
783KB

MD5
7f3294b1b10b086cee0c2f9f4cad4a44

SHA1
3919b25280d25dc5deea3d34ddf9514626b7b018

SHA256
e999aec023590c59392f9f7696f3d289aaac23b4d349e081f300d3c46f45bc13

SHA512
2266699746bd25d274bb73bec2ced408bbfacd763d4f44edad4b8023ec2903bb94442d7035d0acb2b951cac8f46812034ed1cb136a8ea781f771def1c4cd6fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\717.exe

Filesize
720KB

MD5
866b5b2163c1478071179682952d2b24

SHA1
53d06993c0913d9d8af0740f94417c5cfac52cfa

SHA256
4db9e17d126856919f1366761d80bbb6b852b4f14aa9b4698c50de83ddbe74df

SHA512
53ea9b38146e6cdf7d39395ecf84a2e0e108052da270811104d6217960965247ee1ceb8a559ff4b2de716ab367fc445d39b4a7f832e5daf06aac9a89b6ee4304

Download Submit
C:\Users\Admin\AppData\Local\Temp\717.exe

Filesize
720KB

MD5
866b5b2163c1478071179682952d2b24

SHA1
53d06993c0913d9d8af0740f94417c5cfac52cfa

SHA256
4db9e17d126856919f1366761d80bbb6b852b4f14aa9b4698c50de83ddbe74df

SHA512
53ea9b38146e6cdf7d39395ecf84a2e0e108052da270811104d6217960965247ee1ceb8a559ff4b2de716ab367fc445d39b4a7f832e5daf06aac9a89b6ee4304

Download Submit
C:\Users\Admin\AppData\Local\Temp\DBCE.exe

Filesize
421KB

MD5
331e9467ace2c12e1142a7af3861be0a

SHA1
d148319627a24bef5de80ee1dc8d805b7322db64

SHA256
2c8158054be8f59049ffba2ef8555dbe76812ddef3628dc9e06491ee982f1c61

SHA512
19c8c715d50771737803da03ed97a487012aa1586e68f51db3c437adbc8c69721400ab32b1ecedce05d53ffd7467d9f7cae054e3b763dde7f475155a6678b589

Download Submit
C:\Users\Admin\AppData\Local\Temp\DBCE.exe

Filesize
421KB

MD5
331e9467ace2c12e1142a7af3861be0a

SHA1
d148319627a24bef5de80ee1dc8d805b7322db64

SHA256
2c8158054be8f59049ffba2ef8555dbe76812ddef3628dc9e06491ee982f1c61

SHA512
19c8c715d50771737803da03ed97a487012aa1586e68f51db3c437adbc8c69721400ab32b1ecedce05d53ffd7467d9f7cae054e3b763dde7f475155a6678b589

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCD4.exe

Filesize
720KB

MD5
34c9b2563434dc04cfc5ec0d165076ea

SHA1
983a62d491972c8e50af42e133a7f126cd18ffb9

SHA256
beb1bdbc9b36231fe4e5319229e8316c75520551b717d5dde566f99be9e3a97e

SHA512
aecee67131b9de6e9749e59dfcbd9468ce412bad899064eab56745b335f40cd0e40c0f1ec9b69b2237fe1f0312c6a7e873852fb0f9750f0b0e7e65cc1ad55a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCD4.exe

Filesize
720KB

MD5
34c9b2563434dc04cfc5ec0d165076ea

SHA1
983a62d491972c8e50af42e133a7f126cd18ffb9

SHA256
beb1bdbc9b36231fe4e5319229e8316c75520551b717d5dde566f99be9e3a97e

SHA512
aecee67131b9de6e9749e59dfcbd9468ce412bad899064eab56745b335f40cd0e40c0f1ec9b69b2237fe1f0312c6a7e873852fb0f9750f0b0e7e65cc1ad55a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
3990e96786a7e747582a5602a0a737c0

SHA1
97216187976c789e8e5607c97dfa237cd3830fa3

SHA256
de2cd2cf517def1db1d199d4ce15749f6ee78842661486c29a84c678f3cc3361

SHA512
d36e580b26d98e553a56b790d82f6ed58ffeb9b4855525787f1d6806e7fea3836e59ea794b446cb215debf0697607daa673d61aafec4c0c17d66259af88063a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
3990e96786a7e747582a5602a0a737c0

SHA1
97216187976c789e8e5607c97dfa237cd3830fa3

SHA256
de2cd2cf517def1db1d199d4ce15749f6ee78842661486c29a84c678f3cc3361

SHA512
d36e580b26d98e553a56b790d82f6ed58ffeb9b4855525787f1d6806e7fea3836e59ea794b446cb215debf0697607daa673d61aafec4c0c17d66259af88063a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Filesize
95.4MB

MD5
3990e96786a7e747582a5602a0a737c0

SHA1
97216187976c789e8e5607c97dfa237cd3830fa3

SHA256
de2cd2cf517def1db1d199d4ce15749f6ee78842661486c29a84c678f3cc3361

SHA512
d36e580b26d98e553a56b790d82f6ed58ffeb9b4855525787f1d6806e7fea3836e59ea794b446cb215debf0697607daa673d61aafec4c0c17d66259af88063a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe

Filesize
20KB

MD5
fdd1636981a691eda3fda7458f7d10d0

SHA1
3b20a5d550ccf66718a83674745e7353b27b0870

SHA256
ef1d21c1510eaa3465e4dccc76183b756f163658d8a830181c7f7e9b9d4c5e4f

SHA512
18dc2b0db9fc2ef91ac4d4ef3920f527ac0b2630cd4bcbe04855dfe635f2237b4f817da8a0a131f41caa2c1f22a2e633e05757b7b1d8a46b889aabbf65fe5901

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe

Filesize
20KB

MD5
fdd1636981a691eda3fda7458f7d10d0

SHA1
3b20a5d550ccf66718a83674745e7353b27b0870

SHA256
ef1d21c1510eaa3465e4dccc76183b756f163658d8a830181c7f7e9b9d4c5e4f

SHA512
18dc2b0db9fc2ef91ac4d4ef3920f527ac0b2630cd4bcbe04855dfe635f2237b4f817da8a0a131f41caa2c1f22a2e633e05757b7b1d8a46b889aabbf65fe5901

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ublunueightcoordinate_s.exe

Filesize
20KB

MD5
fdd1636981a691eda3fda7458f7d10d0

SHA1
3b20a5d550ccf66718a83674745e7353b27b0870

SHA256
ef1d21c1510eaa3465e4dccc76183b756f163658d8a830181c7f7e9b9d4c5e4f

SHA512
18dc2b0db9fc2ef91ac4d4ef3920f527ac0b2630cd4bcbe04855dfe635f2237b4f817da8a0a131f41caa2c1f22a2e633e05757b7b1d8a46b889aabbf65fe5901

Download Submit
memory/1276-223-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/1276-218-0x0000000005F10000-0x0000000005F76000-memory.dmp

Filesize
408KB

Download
memory/1276-224-0x0000000006AD0000-0x0000000006AEA000-memory.dmp

Filesize
104KB

Download
memory/1276-221-0x00000000065C0000-0x00000000065DE000-memory.dmp

Filesize
120KB

Download
memory/1276-208-0x0000000002CF0000-0x0000000002D26000-memory.dmp

Filesize
216KB

Download
memory/1276-210-0x00000000058E0000-0x0000000005F08000-memory.dmp

Filesize
6.2MB

Download
memory/1336-214-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/1336-213-0x0000000000586000-0x00000000005A2000-memory.dmp

Filesize
112KB

Download
memory/1648-147-0x0000000005B50000-0x0000000005BB6000-memory.dmp

Filesize
408KB

Download
memory/1648-141-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1648-145-0x0000000005780000-0x000000000588A000-memory.dmp

Filesize
1.0MB

Download
memory/1648-155-0x00000000065A0000-0x0000000006762000-memory.dmp

Filesize
1.8MB

Download
memory/1648-144-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/1648-154-0x0000000006530000-0x0000000006580000-memory.dmp

Filesize
320KB

Download
memory/1648-143-0x0000000005160000-0x0000000005778000-memory.dmp

Filesize
6.1MB

Download
memory/1648-142-0x0000000004BB0000-0x0000000005154000-memory.dmp

Filesize
5.6MB

Download
memory/1648-150-0x0000000006490000-0x00000000064AE000-memory.dmp

Filesize
120KB

Download
memory/1648-148-0x0000000006330000-0x00000000063C2000-memory.dmp

Filesize
584KB

Download
memory/1648-149-0x00000000063D0000-0x0000000006446000-memory.dmp

Filesize
472KB

Download
memory/1648-164-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1648-146-0x0000000004B50000-0x0000000004B8C000-memory.dmp

Filesize
240KB

Download
memory/1648-140-0x0000000001F60000-0x0000000001FB9000-memory.dmp

Filesize
356KB

Download
memory/1648-159-0x0000000006780000-0x0000000006CAC000-memory.dmp

Filesize
5.2MB

Download
memory/1648-163-0x000000000049D000-0x00000000004D3000-memory.dmp

Filesize
216KB

Download
memory/1648-139-0x000000000049D000-0x00000000004D3000-memory.dmp

Filesize
216KB

Download
memory/1816-238-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1852-229-0x00000000001A0000-0x00000000001A5000-memory.dmp

Filesize
20KB

Download
memory/1852-205-0x00000000001A0000-0x00000000001A5000-memory.dmp

Filesize
20KB

Download
memory/1852-202-0x0000000000190000-0x0000000000199000-memory.dmp

Filesize
36KB

Download
memory/1864-230-0x0000000001220000-0x0000000001226000-memory.dmp

Filesize
24KB

Download
memory/1864-212-0x0000000001220000-0x0000000001226000-memory.dmp

Filesize
24KB

Download
memory/1864-206-0x0000000001210000-0x000000000121B000-memory.dmp

Filesize
44KB

Download
memory/2396-203-0x0000000008890000-0x00000000088B2000-memory.dmp

Filesize
136KB

Download
memory/2396-188-0x0000000000B90000-0x0000000000B9A000-memory.dmp

Filesize
40KB

Download
memory/2396-191-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/2540-201-0x0000000000310000-0x0000000000337000-memory.dmp

Filesize
156KB

Download
memory/2540-200-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/2540-228-0x0000000000340000-0x0000000000362000-memory.dmp

Filesize
136KB

Download
memory/2544-197-0x00000000006F0000-0x00000000006FC000-memory.dmp

Filesize
48KB

Download
memory/2544-196-0x0000000000700000-0x0000000000706000-memory.dmp

Filesize
24KB

Download
memory/2544-227-0x0000000000700000-0x0000000000706000-memory.dmp

Filesize
24KB

Download
memory/3104-222-0x00000000006E0000-0x00000000006E7000-memory.dmp

Filesize
28KB

Download
memory/3104-178-0x00000000006D0000-0x00000000006DB000-memory.dmp

Filesize
44KB

Download
memory/3104-177-0x00000000006E0000-0x00000000006E7000-memory.dmp

Filesize
28KB

Download
memory/3516-192-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3516-190-0x00000000007E7000-0x0000000000803000-memory.dmp

Filesize
112KB

Download
memory/3516-174-0x00000000007E7000-0x0000000000803000-memory.dmp

Filesize
112KB

Download
memory/3516-175-0x00000000005A0000-0x00000000005D7000-memory.dmp

Filesize
220KB

Download
memory/3516-176-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/3976-231-0x0000000001100000-0x0000000001107000-memory.dmp

Filesize
28KB

Download
memory/3976-135-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3976-132-0x00000000004FD000-0x000000000050E000-memory.dmp

Filesize
68KB

Download
memory/3976-133-0x00000000004D0000-0x00000000004D9000-memory.dmp

Filesize
36KB

Download
memory/3976-216-0x00000000010F0000-0x00000000010FD000-memory.dmp

Filesize
52KB

Download
memory/3976-134-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3976-215-0x0000000001100000-0x0000000001107000-memory.dmp

Filesize
28KB

Download
memory/4080-249-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4128-193-0x0000000000860000-0x0000000000865000-memory.dmp

Filesize
20KB

Download
memory/4128-194-0x0000000000850000-0x0000000000859000-memory.dmp

Filesize
36KB

Download
memory/4128-226-0x0000000000860000-0x0000000000865000-memory.dmp

Filesize
20KB

Download
memory/4908-183-0x0000000000840000-0x0000000000849000-memory.dmp

Filesize
36KB

Download
memory/4908-184-0x0000000000830000-0x000000000083F000-memory.dmp

Filesize
60KB

Download
memory/4908-225-0x0000000000840000-0x0000000000849000-memory.dmp

Filesize
36KB

Download
memory/4976-219-0x0000000001310000-0x0000000001318000-memory.dmp

Filesize
32KB

Download
memory/4976-220-0x0000000001300000-0x000000000130B000-memory.dmp

Filesize
44KB

Download
memory/4976-232-0x0000000001310000-0x0000000001318000-memory.dmp

Filesize
32KB

Download