Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
10/01/2023, 09:56
General
- Target 8018d2e6459f8cffa3383b5e9599c74dfedaef7d6bb37247740350b70861a317.exe
- Size 3.7MB
- Sample230110-lymfasbd2s
- SHA256 8018d2e6459f8cffa3383b5e9599c74dfedaef7d6bb37247740350b70861a317
Malware Config
Extracted
-
nullmixer
-
http://hsiens.xyz/
Extracted
-
privateloader
-
http://37.0.10.214/proxies.txt
-
http://37.0.10.244/server.txt
-
http://wfsdragon.ru/api/setStats.php
-
37.0.10.237
-
http://91.241.19.125/pub.php?pub=one
-
http://sarfoods.com/index.php
-
payload_url
https://cdn.discordapp.com/attachments/1003879548242374749/1003976870611669043/NiceProcessX64.bmp
https://cdn.discordapp.com/attachments/1003879548242374749/1003976754358124554/NiceProcessX32.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
Extracted
-
vidar
-
40.1
-
706
-
https://eduarroma.tumblr.com/
-
profile_id
706
Signatures
- Detect Fabookie payload 2 IoCs
- Detects Smokeloader packer 1 IoCs
- Fabookie
Fabookie is facebook account info stealer.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- OnlyLogger
A tiny loader that uses IPLogger to get its payload.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- OnlyLogger payload 3 IoCs
- Vidar Stealer 2 IoCs
- ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 23 IoCs
- Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 9 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 30 IoCs
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 33 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8018d2e6459f8cffa3383b5e9599c74dfedaef7d6bb37247740350b70861a317.exe"C:\Users\Admin\AppData\Local\Temp\8018d2e6459f8cffa3383b5e9599c74dfedaef7d6bb37247740350b70861a317.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS802AD146\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun14cb0288c734.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun14cb0288c734.exeSun14cb0288c734.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun1450fa295d.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun1450fa295d.exeSun1450fa295d.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun14bcce3c43dc0e.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun14bcce3c43dc0e.exeSun14bcce3c43dc0e.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun14c5e128aee.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun14c5e128aee.exeSun14c5e128aee.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 8246⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 8326⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 8766⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 8846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10406⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 10606⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 12486⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 15246⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 17806⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 15286⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 15006⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 16326⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 15006⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 15846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 15926⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 18246⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun14bc990a571115.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun14bc990a571115.exeSun14bc990a571115.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 5764⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun1491868f8d.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun1418553d0419f1.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun144952b6150c3.exe4⤵
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun144952b6150c3.exeSun144952b6150c3.exe1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun1418553d0419f1.exeSun1418553d0419f1.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4864 -ip 48641⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QJLIF.tmp\Sun14bc990a571115.tmp"C:\Users\Admin\AppData\Local\Temp\is-QJLIF.tmp\Sun14bc990a571115.tmp" /SL5="$601BC,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun14bc990a571115.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS802AD146\Sun1491868f8d.exeSun1491868f8d.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\PBrowFile594.exe"C:\Users\Admin\AppData\Local\Temp\PBrowFile594.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 7563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 8163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 8243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 8523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 9963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 8563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 11363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 7683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 13163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 15003⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 15123⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{OR2L-SuE3i-fz0i-2n712}\65547377157.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{OR2L-SuE3i-fz0i-2n712}\73845016232.exe" /mix3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{OR2L-SuE3i-fz0i-2n712}\83480875090.exe" /mix3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 20643⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup.exe" & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f4⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 17123⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-U6V3U.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-U6V3U.tmp\setup_2.tmp" /SL5="$80070,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-HMJH7.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-HMJH7.tmp\setup_2.tmp" /SL5="$90070,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1160 -ip 11601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 224 -ip 2241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1160 -ip 11601⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 560 -p 4380 -ip 43801⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
2.exe
2.exe
3002.exe
3002.exe
3002.exe
Sun1418553d0419f1.exe
Sun1418553d0419f1.exe
Sun144952b6150c3.exe
Sun144952b6150c3.exe
Sun1450fa295d.exe
Sun1450fa295d.exe
Sun1491868f8d.exe
Sun1491868f8d.exe
Sun14bc990a571115.exe
Sun14bc990a571115.exe
Sun14bcce3c43dc0e.exe
Sun14bcce3c43dc0e.exe
Sun14c5e128aee.exe
Sun14c5e128aee.exe
Sun14cb0288c734.exe
Sun14cb0288c734.exe
libcurl.dll
libcurl.dll
libcurlpp.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libgcc_s_dw2-1.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libstdc++-6.dll
libwinpthread-1.dll
libwinpthread-1.dll
setup_install.exe
setup_install.exe
BearVpn 3.exe
BearVpn 3.exe
Chrome 5.exe
Chrome 5.exe
PBrowFile594.exe
PBrowFile594.exe
idp.dll
idp.dll
setup_2.tmp
setup_2.tmp
idp.dll
Sun14bc990a571115.tmp
setup_2.tmp
setup_2.tmp
jhuuee.exe
jhuuee.exe
setup.exe
setup.exe
setup_2.exe
setup_2.exe
setup_2.exe
setup_installer.exe
setup_installer.exe
65547377157.exe
73845016232.exe
83480875090.exe
memory/224-223-0x00000000020A0000-0x000000000213D000-memory.dmp
memory/224-243-0x0000000000400000-0x0000000001DCA000-memory.dmp
memory/224-297-0x0000000002199000-0x00000000021FD000-memory.dmp
memory/224-222-0x0000000002199000-0x00000000021FD000-memory.dmp
memory/448-201-0x0000000000520000-0x0000000000634000-memory.dmp
memory/1160-267-0x0000000001D90000-0x0000000001DBF000-memory.dmp
memory/1160-298-0x0000000000400000-0x0000000001D81000-memory.dmp
memory/1160-265-0x0000000001E77000-0x0000000001E93000-memory.dmp
memory/1160-299-0x0000000001E77000-0x0000000001E93000-memory.dmp
memory/1160-271-0x0000000000400000-0x0000000001D81000-memory.dmp
memory/1932-238-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1932-266-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1932-263-0x0000000000400000-0x0000000000414000-memory.dmp
memory/2468-233-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2468-198-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2468-191-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3520-275-0x00000000037D0000-0x0000000003A24000-memory.dmp
memory/3520-276-0x00000000037D0000-0x0000000003A24000-memory.dmp
memory/3656-264-0x00007FF8839A0000-0x00007FF884461000-memory.dmp
memory/3656-217-0x0000000000960000-0x000000000098E000-memory.dmp
memory/3848-261-0x00007FF8839A0000-0x00007FF884461000-memory.dmp
memory/3848-220-0x00007FF8839A0000-0x00007FF884461000-memory.dmp
memory/3848-204-0x0000000000B90000-0x0000000000BBE000-memory.dmp
memory/4100-257-0x0000000006580000-0x000000000659E000-memory.dmp
memory/4100-288-0x0000000007C30000-0x0000000007C38000-memory.dmp
memory/4100-196-0x0000000002CE0000-0x0000000002D16000-memory.dmp
memory/4100-211-0x0000000005F20000-0x0000000005F86000-memory.dmp
memory/4100-287-0x0000000007C40000-0x0000000007C5A000-memory.dmp
memory/4100-286-0x0000000007B40000-0x0000000007B4E000-memory.dmp
memory/4100-285-0x0000000007B80000-0x0000000007C16000-memory.dmp
memory/4100-284-0x0000000007990000-0x000000000799A000-memory.dmp
memory/4100-206-0x0000000005640000-0x0000000005662000-memory.dmp
memory/4100-282-0x0000000007900000-0x000000000791A000-memory.dmp
memory/4100-202-0x0000000005740000-0x0000000005D68000-memory.dmp
memory/4100-280-0x0000000007F50000-0x00000000085CA000-memory.dmp
memory/4100-277-0x0000000006BC0000-0x0000000006BF2000-memory.dmp
memory/4100-278-0x000000006E910000-0x000000006E95C000-memory.dmp
memory/4100-212-0x0000000005F90000-0x0000000005FF6000-memory.dmp
memory/4100-279-0x0000000006B80000-0x0000000006B9E000-memory.dmp
memory/4112-224-0x0000000001F59000-0x0000000001F62000-memory.dmp
memory/4112-274-0x0000000000400000-0x0000000001D6E000-memory.dmp
memory/4112-234-0x0000000000400000-0x0000000001D6E000-memory.dmp
memory/4112-225-0x0000000001EC0000-0x0000000001EC9000-memory.dmp
memory/4268-260-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4268-273-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4404-300-0x00007FF8839A0000-0x00007FF884461000-memory.dmp
memory/4404-221-0x0000000000E90000-0x0000000000E98000-memory.dmp
memory/4404-251-0x00007FF8839A0000-0x00007FF884461000-memory.dmp
memory/4440-210-0x00000000003A0000-0x00000000003B0000-memory.dmp
memory/4440-249-0x00007FF8839A0000-0x00007FF884461000-memory.dmp
memory/4864-155-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4864-154-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4864-227-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/4864-156-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/4864-157-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/4864-158-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/4864-228-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/4864-232-0x0000000064940000-0x0000000064959000-memory.dmp
memory/4864-162-0x0000000064940000-0x0000000064959000-memory.dmp
memory/4864-159-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/4864-149-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/4864-231-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4864-161-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4864-153-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4864-152-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/4864-150-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/4864-151-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/4916-256-0x0000000000F10000-0x0000000000F18000-memory.dmp