redline | 80edb77e7473d68393b70416a3563b9743e25e0a4b85375ac642e2bfdf0380ef

Analysis

max time kernel
176s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-11-2022 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40f7448691c80ea2483d44d84b1f7d02.exe
Size

4.6MB
MD5

40f7448691c80ea2483d44d84b1f7d02
SHA1

7f572aad898afb99ef6082280d5190deb954c886
SHA256

80edb77e7473d68393b70416a3563b9743e25e0a4b85375ac642e2bfdf0380ef
SHA512

4820979e439ff09ba47f1286d09f2c9513bb62fcfb309364b5707b7868ce226661a0f02e36c76cf8ce8308c95d9c46c01c53076fbcd4ecb1c28e5d7490eb5a67
SSDEEP

98304:5Fjrg3ipseLuX6aBLdeQZfKA3c3uiAPnJS2fnEAnzMJq3xo:PUypsDT5KAM3kvJSinpnhx

Score

10^/10

redline discovery evasion infostealer spyware stealer themida trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-63-0x0000000002AF0000-0x0000000002B44000-memory.dmp	family_redline
behavioral1/memory/1900-64-0x0000000002B90000-0x0000000002BE2000-memory.dmp	family_redline
behavioral1/memory/1900-70-0x00000000084A0000-0x0000000008FF1000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

40f7448691c80ea2483d44d84b1f7d02.exeCheck.exesvcupdater.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	40f7448691c80ea2483d44d84b1f7d02.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Check.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svcupdater.exe

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

Check.exesvcupdater.exe

pid process

268 Check.exe
1908 svcupdater.exe

pid	process
268	Check.exe
1908	svcupdater.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

40f7448691c80ea2483d44d84b1f7d02.exeCheck.exesvcupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	40f7448691c80ea2483d44d84b1f7d02.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	40f7448691c80ea2483d44d84b1f7d02.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Check.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Check.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svcupdater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svcupdater.exe

Loads dropped DLL 2 IoCs

Processes:

40f7448691c80ea2483d44d84b1f7d02.exetaskeng.exe

pid process

1900 40f7448691c80ea2483d44d84b1f7d02.exe
1936 taskeng.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1900	40f7448691c80ea2483d44d84b1f7d02.exe
1936	taskeng.exe

Themida packer 22 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\Check.exe	themida
C:\Users\Admin\AppData\Local\Temp\Check.exe	themida
behavioral1/memory/268-69-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-71-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-72-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-74-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-75-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-76-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-77-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\Check.exe	themida
behavioral1/memory/268-83-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
behavioral1/memory/268-85-0x0000000000200000-0x0000000000D51000-memory.dmp	themida
\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe	themida
C:\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe	themida
behavioral1/memory/1908-90-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-92-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-93-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-91-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-95-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-96-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-97-0x0000000000010000-0x0000000000B61000-memory.dmp	themida
behavioral1/memory/1908-99-0x0000000000010000-0x0000000000B61000-memory.dmp	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

40f7448691c80ea2483d44d84b1f7d02.exeCheck.exesvcupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	40f7448691c80ea2483d44d84b1f7d02.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Check.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svcupdater.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

40f7448691c80ea2483d44d84b1f7d02.exeCheck.exesvcupdater.exe

pid process

1900 40f7448691c80ea2483d44d84b1f7d02.exe
268 Check.exe
1908 svcupdater.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1688 schtasks.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 14 Go-http-client/1.1

pid	process
1900	40f7448691c80ea2483d44d84b1f7d02.exe
268	Check.exe
1908	svcupdater.exe

pid	process
1688	schtasks.exe

description	flow	ioc
HTTP User-Agent header	14	Go-http-client/1.1

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

40f7448691c80ea2483d44d84b1f7d02.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	40f7448691c80ea2483d44d84b1f7d02.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	40f7448691c80ea2483d44d84b1f7d02.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	40f7448691c80ea2483d44d84b1f7d02.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	40f7448691c80ea2483d44d84b1f7d02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	40f7448691c80ea2483d44d84b1f7d02.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	40f7448691c80ea2483d44d84b1f7d02.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

40f7448691c80ea2483d44d84b1f7d02.exe

pid process

1900 40f7448691c80ea2483d44d84b1f7d02.exe
1900 40f7448691c80ea2483d44d84b1f7d02.exe
1900 40f7448691c80ea2483d44d84b1f7d02.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

40f7448691c80ea2483d44d84b1f7d02.exe

description pid process

Token: SeDebugPrivilege 1900 40f7448691c80ea2483d44d84b1f7d02.exe

pid	process
1900	40f7448691c80ea2483d44d84b1f7d02.exe
1900	40f7448691c80ea2483d44d84b1f7d02.exe
1900	40f7448691c80ea2483d44d84b1f7d02.exe

description	pid	process
Token: SeDebugPrivilege	1900	40f7448691c80ea2483d44d84b1f7d02.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

40f7448691c80ea2483d44d84b1f7d02.exeCheck.execmd.exetaskeng.exe

description	pid	process	target process
PID 1900 wrote to memory of 268	1900	40f7448691c80ea2483d44d84b1f7d02.exe	Check.exe
PID 1900 wrote to memory of 268	1900	40f7448691c80ea2483d44d84b1f7d02.exe	Check.exe
PID 1900 wrote to memory of 268	1900	40f7448691c80ea2483d44d84b1f7d02.exe	Check.exe
PID 1900 wrote to memory of 268	1900	40f7448691c80ea2483d44d84b1f7d02.exe	Check.exe
PID 268 wrote to memory of 432	268	Check.exe	cmd.exe
PID 268 wrote to memory of 432	268	Check.exe	cmd.exe
PID 268 wrote to memory of 432	268	Check.exe	cmd.exe
PID 432 wrote to memory of 1688	432	cmd.exe	schtasks.exe
PID 432 wrote to memory of 1688	432	cmd.exe	schtasks.exe
PID 432 wrote to memory of 1688	432	cmd.exe	schtasks.exe
PID 1936 wrote to memory of 1908	1936	taskeng.exe	svcupdater.exe
PID 1936 wrote to memory of 1908	1936	taskeng.exe	svcupdater.exe
PID 1936 wrote to memory of 1908	1936	taskeng.exe	svcupdater.exe

C:\Users\Admin\AppData\Local\Temp\40f7448691c80ea2483d44d84b1f7d02.exe
"C:\Users\Admin\AppData\Local\Temp\40f7448691c80ea2483d44d84b1f7d02.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Users\Admin\AppData\Local\Temp\Check.exe
  "C:\Users\Admin\AppData\Local\Temp\Check.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\cmd.exe
    cmd.exe /C schtasks /create /tn oeItRUniJV /tr C:\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn oeItRUniJV /tr C:\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Creates scheduled task(s)
      PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {E7693DB9-94E2-490F-97BF-3F6F807C3F06} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:1908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Check.exe

Filesize
3.5MB

MD5
50153b21abcf5baf17ef600b56cec717

SHA1
6ea0838ace157f1c71bca27acffd0fe57a9027e1

SHA256
99c08c22c427d7b3ad1d8ac8bc371597030cd477b15dfb494a3a66d65fbc99dd

SHA512
765a949f58b680302c68cdc87ae20decc433eacbaf477d1da7d26800e30f1db1ca12bc007f79b500cfc684e6f91c08fc8c0a76d57cb67c63231680287a18b1f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Check.exe

Filesize
3.5MB

MD5
50153b21abcf5baf17ef600b56cec717

SHA1
6ea0838ace157f1c71bca27acffd0fe57a9027e1

SHA256
99c08c22c427d7b3ad1d8ac8bc371597030cd477b15dfb494a3a66d65fbc99dd

SHA512
765a949f58b680302c68cdc87ae20decc433eacbaf477d1da7d26800e30f1db1ca12bc007f79b500cfc684e6f91c08fc8c0a76d57cb67c63231680287a18b1f0

Download Submit
C:\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe

Filesize
3.5MB

MD5
50153b21abcf5baf17ef600b56cec717

SHA1
6ea0838ace157f1c71bca27acffd0fe57a9027e1

SHA256
99c08c22c427d7b3ad1d8ac8bc371597030cd477b15dfb494a3a66d65fbc99dd

SHA512
765a949f58b680302c68cdc87ae20decc433eacbaf477d1da7d26800e30f1db1ca12bc007f79b500cfc684e6f91c08fc8c0a76d57cb67c63231680287a18b1f0

Download Submit
\Users\Admin\AppData\Local\Temp\Check.exe

Filesize
3.5MB

MD5
50153b21abcf5baf17ef600b56cec717

SHA1
6ea0838ace157f1c71bca27acffd0fe57a9027e1

SHA256
99c08c22c427d7b3ad1d8ac8bc371597030cd477b15dfb494a3a66d65fbc99dd

SHA512
765a949f58b680302c68cdc87ae20decc433eacbaf477d1da7d26800e30f1db1ca12bc007f79b500cfc684e6f91c08fc8c0a76d57cb67c63231680287a18b1f0

Download Submit
\Users\Admin\AppData\Roaming\oeItRUniJV\svcupdater.exe

Filesize
3.5MB

MD5
50153b21abcf5baf17ef600b56cec717

SHA1
6ea0838ace157f1c71bca27acffd0fe57a9027e1

SHA256
99c08c22c427d7b3ad1d8ac8bc371597030cd477b15dfb494a3a66d65fbc99dd

SHA512
765a949f58b680302c68cdc87ae20decc433eacbaf477d1da7d26800e30f1db1ca12bc007f79b500cfc684e6f91c08fc8c0a76d57cb67c63231680287a18b1f0

Download Submit
memory/268-76-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-69-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-86-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/268-85-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-84-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/268-83-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-72-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-73-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/268-67-0x0000000000000000-mapping.dmp

Download
memory/268-77-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-74-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-75-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/268-71-0x0000000000200000-0x0000000000D51000-memory.dmp

Filesize
11.3MB

Download
memory/432-79-0x0000000000000000-mapping.dmp

Download
memory/1688-81-0x0000000000000000-mapping.dmp

Download
memory/1900-80-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-56-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-54-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-58-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-57-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1900-59-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-60-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-65-0x0000000077010000-0x0000000077190000-memory.dmp

Filesize
1.5MB

Download
memory/1900-82-0x0000000077010000-0x0000000077190000-memory.dmp

Filesize
1.5MB

Download
memory/1900-64-0x0000000002B90000-0x0000000002BE2000-memory.dmp

Filesize
328KB

Download
memory/1900-63-0x0000000002AF0000-0x0000000002B44000-memory.dmp

Filesize
336KB

Download
memory/1900-62-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1900-61-0x0000000077010000-0x0000000077190000-memory.dmp

Filesize
1.5MB

Download
memory/1900-70-0x00000000084A0000-0x0000000008FF1000-memory.dmp

Filesize
11.3MB

Download
memory/1900-55-0x0000000000400000-0x0000000000C83000-memory.dmp

Filesize
8.5MB

Download
memory/1908-88-0x0000000000000000-mapping.dmp

Download
memory/1908-90-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-92-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-94-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/1908-93-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-91-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-95-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-96-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-97-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-99-0x0000000000010000-0x0000000000B61000-memory.dmp

Filesize
11.3MB

Download
memory/1908-100-0x0000000076E30000-0x0000000076FD9000-memory.dmp

Filesize
1.7MB

Download
memory/1936-98-0x0000000002710000-0x0000000003261000-memory.dmp

Filesize
11.3MB

Download